363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb

Analysis

max time kernel
65s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bitcheats_cleaner.exe
Size

2.5MB
MD5

24999353450c234c36cc2e0a74f75051
SHA1

3b716b36775bc53bd67c0786ed040628cbc926f9
SHA256

363f8d66fa5bd0c72eb46fd821a2eb09e723e2f42e6bb293212f07ab0c2b5ddb
SHA512

1c0dfac601da714ffc0a3dcd5f6b1fbe95c7238177cbf3ab9551b833f5a062c717ab69ff206a7c9dee677b52cec1cb81efd4e36dc6af5fc195ab07e4e453d143
SSDEEP

49152:rabHjq7IZiuzkKECE95eHmRSW97qWOEhSI7o1U26TYtkY+toY:rabOUiujECE95eGRB718zgY4

Score

9^/10

evasion spyware stealer themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

bitcheats_cleaner.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ bitcheats_cleaner.exe
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4640 netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bitcheats_cleaner.exe

pid	process
4640	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bitcheats_cleaner.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bitcheats_cleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bitcheats_cleaner.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

bitcheats_cleaner.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation bitcheats_cleaner.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	bitcheats_cleaner.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/4608-0-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-2-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-4-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-3-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-5-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-6-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-51-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-169-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida
behavioral2/memory/4608-176-0x00007FF712A60000-0x00007FF713184000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bitcheats_cleaner.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bitcheats_cleaner.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

bitcheats_cleaner.exe

pid process

4608 bitcheats_cleaner.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bitcheats_cleaner.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exe

pid process

2580 ipconfig.exe
4840 ipconfig.exe
544 ipconfig.exe
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

4692 reg.exe
3660 reg.exe
3968 reg.exe

pid	process
2580	ipconfig.exe
4840	ipconfig.exe
544	ipconfig.exe

pid	process
4692	reg.exe
3660	reg.exe
3968	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bitcheats_cleaner.exe

pid	process
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe
4608	bitcheats_cleaner.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bitcheats_cleaner.exe

pid process

4608 bitcheats_cleaner.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2132 msedge.exe
2132 msedge.exe
2132 msedge.exe
2132 msedge.exe
2132 msedge.exe
2132 msedge.exe
2132 msedge.exe
2132 msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bitcheats_cleaner.exemsedge.exe

description	pid	process	target process
PID 4608 wrote to memory of 2132	4608	bitcheats_cleaner.exe	msedge.exe
PID 4608 wrote to memory of 2132	4608	bitcheats_cleaner.exe	msedge.exe
PID 2132 wrote to memory of 2596	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2596	2132	msedge.exe	msedge.exe
PID 4608 wrote to memory of 1656	4608	bitcheats_cleaner.exe	cmd.exe
PID 4608 wrote to memory of 1656	4608	bitcheats_cleaner.exe	cmd.exe
PID 4608 wrote to memory of 3068	4608	bitcheats_cleaner.exe	Conhost.exe
PID 4608 wrote to memory of 3068	4608	bitcheats_cleaner.exe	Conhost.exe
PID 4608 wrote to memory of 4568	4608	bitcheats_cleaner.exe	cmd.exe
PID 4608 wrote to memory of 4568	4608	bitcheats_cleaner.exe	cmd.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 3112	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1360	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1360	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2164	2132	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner.exe
"C:\Users\Admin\AppData\Local\Temp\bitcheats_cleaner.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bitcheats.net/
2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffffe346f8,0x7fffffe34708,0x7fffffe34718
3⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
3⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
3⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
3⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
3⤵
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
3⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
3⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
3⤵
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
3⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
3⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
3⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
3⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
3⤵
PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17798660018049235302,4581767776285868596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
3⤵
PID:1236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\
2⤵
PID:1656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History\
2⤵
PID:3068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\
2⤵
PID:4568

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\
2⤵
PID:3312

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Temp\
2⤵
PID:512

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\
2⤵
PID:4956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Temp\
2⤵
PID:5104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
2⤵
PID:2128

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye\BEService_fn.exe
2⤵
PID:2648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe\gpa.bin
2⤵
PID:628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451b49097cdafa85ec0f45214d6b0df9e8d.bin
2⤵
PID:3856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\DxCache\92b1da15789e5451e900a9bc20b57cd2f45214d6b0df9e8d.bin
2⤵
PID:1244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64\Version 2.1 AMD-APP (3380.6).Ellesmere.cache
2⤵
PID:3904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.idx
2⤵
PID:3556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.lock
2⤵
PID:756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84\52264C4C-172F-41B9-91B8-7F0C3B1E9021_VEN_1002&DEV_67DF&SUBSYS_C580&REV_E7.val
2⤵
PID:4340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\f_00010e
2⤵
PID:4832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000036.log
2⤵
PID:2988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\000038.ldb
2⤵
PID:408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG.old
2⤵
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK\FortniteClient-Win64-Shipping_12856.log
2⤵
PID:2412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\Temp\171cac9.tmp
2⤵
PID:520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient\Manifest.ini
2⤵
PID:1756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor\Manifest.ini
2⤵
PID:2984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics\8E1D46DBC38F4A789939D781E1B91520
2⤵
PID:3100

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor\Engine.ini
2⤵
PID:4652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs\CrashReportClient.log
2⤵
PID:532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329\ClientSettings.Sav
2⤵
PID:1752

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\ClientSettings.Sav
2⤵
PID:3000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8\CrashReportClient.ini
2⤵
PID:3740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
2⤵
PID:3548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
2⤵
PID:3296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
2⤵
PID:4796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteLauncher.log
2⤵
PID:3904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap\TempFileURLMappings.urlmap
2⤵
PID:3556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\DownloadCache.json
2⤵
PID:756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\08B44835D9E8B3BEDFB49C3650F634FF11B74454.jpeg
2⤵
PID:4396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\1773DBBF630BAD44B34734176DD5D03F2E6F4D78.png
2⤵
PID:3912

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\86F7F05520A581636CEBF3AD1BD5C4383AE77494.png
2⤵
PID:3352

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\88271B0993D67835C1C89BF7D1B9A1E5ED989F06.jpg
2⤵
PID:3344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B666DE51F8E930A8A99CB03C4454727680759203.jpg
2⤵
PID:3068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\B6D962B44AD39D2129B4A96DB8C24DFF6A98D213.jpeg
2⤵
PID:4420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\D04ECBD1A835D9714A6F6D279077C15B2FCEDBEF.jpeg
2⤵
PID:4868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\EA7CDAA7AF5B1335517D581803C34BB2394218D1.png
2⤵
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2\ED43DE88DA78F8F4D6645415A7FC446EAE3BD5B8.jpeg
2⤵
PID:952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0bef34491af34fc584b687e433656e90
2⤵
PID:664

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\0ef043433c754e0588525283cacda0ab
2⤵
PID:4180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\1492c7f2588940848a4920cdff4e69d7
2⤵
PID:3796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\20334c6a270641c0835bed15d9cde4ea
2⤵
PID:1480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\3460cbe1c57d4a838ace32951a4d7171
2⤵
PID:3000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\6dea1559a81c4b18864782deeba57a83
2⤵
PID:3740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\7e2a66ce68554814b1bd0aa14351cd71
2⤵
PID:3388

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\8b616e78d2674a3e92157d40df1d4cda
2⤵
PID:5008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\a22d837b6a2b46349421259c0a5411bf
2⤵
PID:4980

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b4b8bebcb5e84d86b11ebb7bb989d88f
2⤵
PID:1200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b6c60402a72e4081a6a47c641371c19f
2⤵
PID:4328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\b800b911053c4906a5bd399f46ae0055
2⤵
PID:4340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\be84cc30e34142d293ed27d15522b62c
2⤵
PID:1388

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c52c1f9246eb48ce9dade87be5a66f29
2⤵
PID:4768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\c7dee411e20a44ab930f841e8d206b1b
2⤵
PID:1608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS\f2f660d7855c45fdbb7922edda562a60
2⤵
PID:5064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\ManifestArchive.journal
2⤵
PID:4956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup\BuildIdentity.txt
2⤵
PID:1860

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4420

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw\Full.ini
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw.manifest
2⤵
PID:4944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\BESERVICE.EXE-622E150D.pf
2⤵
PID:3208

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\CRASHREPORTCLIENT.EXE-C297728D.pf
2⤵
PID:3516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\EASYANTICHEAT_SETUP.EXE-CF3441CE.pf
2⤵
PID:3764

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-42C11B98.pf
2⤵
PID:2044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITECLIENT-WIN64-SHIPPING-5EAA410A.pf
2⤵
PID:1848

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\FORTNITELAUNCHER.EXE-AF00A2B5.pf
2⤵
PID:3560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\Prefetch\RUNDLL32.EXE-F264FACF.pf
2⤵
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
2⤵
PID:800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
2⤵
PID:4620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
2⤵
PID:4488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
2⤵
PID:1960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
2⤵
PID:1356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
2⤵
PID:640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
2⤵
PID:860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
2⤵
PID:4480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\e4988bfc0f4c4c6596237473da200329.dat
2⤵
PID:4080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
2⤵
PID:4016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
2⤵
PID:4692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_0
2⤵
PID:2800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_1
2⤵
PID:1956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_2
2⤵
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Cache\data_3
2⤵
PID:512

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\9f9fe5b8b6d30293_0
2⤵
PID:1340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\e7a03ae0f25a578a_0
2⤵
PID:2128

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Code Cache\js\index-dir\the-real-index
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG
2⤵
PID:2016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\LOG.old
2⤵
PID:2368

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\IndexedDB\https_launcher.store.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
2⤵
PID:4336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\000003.log
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Local Storage\leveldb\LOG
2⤵
PID:744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\LOG
2⤵
PID:4168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Network Persistent State
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager
2⤵
PID:3520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\QuotaManager-journal
2⤵
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\000003.log
2⤵
PID:3628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Service Worker\Database\LOG
2⤵
PID:5104

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2044

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\000003.log
2⤵
PID:2128

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\Session Storage\LOG
2⤵
PID:628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache_4430\TransportSecurity
2⤵
PID:1548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files (x86)\Common Files\BattlEye
2⤵
PID:4528

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport
2⤵
PID:2488

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\CN\GameReport\FortniteClient-Win64-Shipping.exe
2⤵
PID:2988

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache
2⤵
PID:3412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\AMD\cl.cache\x64
2⤵
PID:4868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\D3DSCache\e4548a4577c56a84
2⤵
PID:5004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\NVIDIA Corporation\GfeSDK
2⤵
PID:4676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\
2⤵
PID:3100

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved
2⤵
PID:4860

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:512

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config
2⤵
PID:1512

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsClient
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\5.0\Saved\Config\WindowsEditor
2⤵
PID:3296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common
2⤵
PID:3244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\UnrealEngine\Common\Analytics
2⤵
PID:4908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved
2⤵
PID:744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config
2⤵
PID:4124

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Config\WindowsEditor
2⤵
PID:3220

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\CrashReportClient\Saved\Logs
2⤵
PID:1456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:3208

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
2⤵
PID:3036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\e4988bfc0f4c4c6596237473da200329
2⤵
PID:1236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config
2⤵
PID:2016

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
2⤵
PID:3104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UECC-Windows-F4478CA54827E7195F8F7BBAB4BC51F8
2⤵
PID:4352

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
2⤵
PID:3364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
2⤵
PID:448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
2⤵
PID:4252

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp
2⤵
PID:3208

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\BackgroundHttp\URLMap
2⤵
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS
2⤵
PID:1068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files
2⤵
PID:3104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\Files\C28FF1DE0C661DAF01E118A30B3F21B897A7A6E2
2⤵
PID:936

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\EMS
2⤵
PID:4332

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles
2⤵
PID:3772

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\CosmeticBundleSeparateCosmetics
2⤵
PID:400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBR
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteBROptional
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreative
2⤵
PID:3628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FortniteCreativeOptional
2⤵
PID:4948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEnd
2⤵
PID:628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\FrontEndOptional
2⤵
PID:1756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCapture
2⤵
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\KairosCaptureOptional
2⤵
PID:1068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.all
2⤵
PID:3104

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.allOptional
2⤵
PID:936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.de
2⤵
PID:3812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.deOptional
2⤵
PID:1724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419
2⤵
PID:964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-419Optional
2⤵
PID:2692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ES
2⤵
PID:1716

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.es-ESOptional
2⤵
PID:5000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.fr
2⤵
PID:452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.frOptional
2⤵
PID:3076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.it
2⤵
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.itOptional
2⤵
PID:3908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.pl
2⤵
PID:4600

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.plOptional
2⤵
PID:4332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ru
2⤵
PID:4220

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.ruOptional
2⤵
PID:5004

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CN
2⤵
PID:4856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Lang.zh-CNOptional
2⤵
PID:2692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\Startup
2⤵
PID:1716

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\InstalledBundles\StartupOptional
2⤵
PID:5000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache
2⤵
PID:1584

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\ManifestCache\VkeX0y1esOdbd-ggEkmjBETCpYALDw
2⤵
PID:3624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles
2⤵
PID:4684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\CosmeticBundleSeparateCosmetics
2⤵
PID:2368

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBR
2⤵
PID:4908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteBROptional
2⤵
PID:4492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreative
2⤵
PID:448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FortniteCreativeOptional
2⤵
PID:4696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEnd
2⤵
PID:964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\FrontEndOptional
2⤵
PID:1648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCapture
2⤵
PID:4384

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\KairosCaptureOptional
2⤵
PID:3012

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:520

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.all
2⤵
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.allOptional
2⤵
PID:4048

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.de
2⤵
PID:3548

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.deOptional
2⤵
PID:456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419
2⤵
PID:2456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-419Optional
2⤵
PID:1188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ES
2⤵
PID:4968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.es-ESOptional
2⤵
PID:3660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.fr
2⤵
PID:4860

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.frOptional
2⤵
PID:1580

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.it
2⤵
PID:3428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.itOptional
2⤵
PID:3020

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.pl
2⤵
PID:4016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.plOptional
2⤵
PID:2120

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:5008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ru
2⤵
PID:1236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.ruOptional
2⤵
PID:4328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CN
2⤵
PID:4656

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\Lang.zh-CNOptional
2⤵
PID:4832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\StagingBundles\StartupOptional
2⤵
PID:4252

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
2⤵
PID:2160

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BEService /f
3⤵
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
2⤵
PID:232

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4856

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BEService /f
3⤵
PID:1276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
2⤵
PID:1580

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1648

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EasyAntiCheat /f
3⤵
PID:888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
2⤵
PID:4360

C:\Windows\system32\reg.exe
REG DELETE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EasyAntiCheat /f
3⤵
PID:2292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.etl
2⤵
PID:3304

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.log
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.temp
2⤵
PID:2240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.dmp
2⤵
PID:3628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.chk
2⤵
PID:1164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bup
2⤵
PID:4692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bac
2⤵
PID:3320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.bak
2⤵
PID:5000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\*.old
2⤵
PID:2696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:4760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir
2⤵
PID:4640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\Staged\a1acda587b3e4c7b87df4eb11fece3c0.dat
2⤵
PID:2908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\a1acda587b3e4c7b87df4eb11fece3c0.dat
2⤵
PID:1804

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000067
2⤵
PID:3760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Intel\ShaderCache\EpicGamesLauncher_1
2⤵
PID:1192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
2⤵
PID:3376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
2⤵
PID:2016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_www.epicgames.com_0.localstorage
2⤵
PID:4700

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases
2⤵
PID:3400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage
2⤵
PID:2676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_1
2⤵
PID:2304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_1
2⤵
PID:804

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_1
2⤵
PID:1344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_1
2⤵
PID:2240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_1
2⤵
PID:2572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
2⤵
PID:2984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_1
2⤵
PID:4856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
2⤵
PID:3956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004d
2⤵
PID:4784

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage
2⤵
PID:844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004e
2⤵
PID:1948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00004f
2⤵
PID:3504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000050
2⤵
PID:4480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000051
2⤵
PID:1860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000052
2⤵
PID:5080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000053
2⤵
PID:3456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\
2⤵
PID:4772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\47343f26116f49d1a460ad740dc2bbbb\ClientSettings.Sav
2⤵
PID:2176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher
2⤵
PID:4956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye
2⤵
PID:336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys
2⤵
PID:2028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\CommonFiles\BattlEye\BEDaisy.sys\
2⤵
PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat
2⤵
PID:1264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.sys
2⤵
PID:3292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Engine\Programs\CrashReportClient\Config\DefaultEngine.ini
2⤵
PID:3556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\VaultCache
2⤵
PID:5004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32
2⤵
PID:3036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\EpicGames\Launcher\Portal\Binaries\Win32\
2⤵
PID:3352

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Base.ini
2⤵
PID:964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseGame.ini
2⤵
PID:4776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\BaseInput.ini
2⤵
PID:3364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\BaseWindowsLightmass.ini
2⤵
PID:4524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Engine\Config\Windows\WindowsGame.ini
2⤵
PID:4692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)\Epic Games\Launcher\Portal\Config\UserLightmass.ini
2⤵
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Engine\Config\BaseHardware.ini
2⤵
PID:3164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\NotForLicensees\Windows\WindowsHardware.ini
2⤵
PID:4684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files(x86)Epic Games\Launcher\Portal\Config\UserScalability.ini
2⤵
PID:2712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\CMS
2⤵
PID:2400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite1\FortniteGame\PersistentDownloadDir\EMS
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Config\NoRedist\Windows\ShippableWindowsGameUserSettings.ini
2⤵
PID:3028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:3284

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\CurveEditorTools\AssetRegistry.bin
2⤵
PID:2844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CryptoKeys\AssetRegistry.bin
2⤵
PID:2108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins\Editor\CurveEditorTools\AssetRegistry.bin
2⤵
PID:1324

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\FortniteClient-Win64-Shipping.exe.local
2⤵
PID:396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files
2⤵
PID:2648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\Shared Files:VersionCache
2⤵
PID:4440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\SharedFiles:VersionCache
2⤵
PID:544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Binaries\Win64\XSettings.Sav
2⤵
PID:4352

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:1016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir\CMS
2⤵
PID:4812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Epic\EpicGamesLauncher\Data\EMS\stage
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:4964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud
2⤵
PID:4532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\d945f059b8b54aa58202ed2989bebfc8
2⤵
PID:956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config
2⤵
PID:3288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient
2⤵
PID:3792

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-AED3596C4ADFAC4DB9E422A6546810D3
2⤵
PID:4384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient
2⤵
PID:2264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Demos
2⤵
PID:4620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS
2⤵
PID:3024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\Logs
2⤵
PID:2276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher\
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame
2⤵
PID:4836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
2⤵
PID:548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Users\%Username%\AppData\Local\BattlEye
2⤵
PID:852

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\Program Files (x86)\Epic Games\Launcher\Portal\Content\New UI\White.png
2⤵
PID:224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:Program FilesEpic GamesFortniteFortniteGameBinariesWin64Shared Files
2⤵
PID:1624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Intermediate\Config\CoalescedSourceConfigs\PortalRegions.ini
2⤵
PID:2608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-72CCB9004D132462217ECE948BC03CBE\CrashReportClient.ini
2⤵
PID:3380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\CrashReportClient\UE4CC-Windows-E3661BE544621B07B291448442161091\CrashReportClient.ini
2⤵
PID:1308

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Compat.ini
2⤵
PID:4164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\EditorPerProjectUserSettings.ini
2⤵
PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Engine.ini
2⤵
PID:2316

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Game.ini
2⤵
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\GameUserSettings.ini
2⤵
PID:4556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Hardware.ini
2⤵
PID:3372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Input.ini
2⤵
PID:3756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\Lightmass.ini
2⤵
PID:1472

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Config\Windows\PortalRegions.ini
2⤵
PID:4680

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\65f6b08d488442e694b1e23d152d971e.dat
2⤵
PID:1340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\b371f0ee15b74eba84bd23830461130c.dat
2⤵
PID:1828

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_65f6b08d488442e694b1e23d152d971e.dat
2⤵
PID:5064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Data\OC_b371f0ee15b74eba84bd23830461130c.dat
2⤵
PID:4796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\cef3.log
2⤵
PID:3748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher.log
2⤵
PID:908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\Logs\EpicGamesLauncher_2.log
2⤵
PID:4668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_0
2⤵
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_1
2⤵
PID:2152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_2
2⤵
PID:1572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\data_3
2⤵
PID:4820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000001
2⤵
PID:5080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000002
2⤵
PID:3456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000004
2⤵
PID:2604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000005
2⤵
PID:1452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000006
2⤵
PID:396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000007
2⤵
PID:3000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000008
2⤵
PID:1364

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000009
2⤵
PID:1264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000a
2⤵
PID:1180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000b
2⤵
PID:1016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000c
2⤵
PID:5004

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000d
2⤵
PID:3568

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000e
2⤵
PID:4964

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00000f
2⤵
PID:4532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000010
2⤵
PID:956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000011
2⤵
PID:2148

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000012
2⤵
PID:3792

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000013
2⤵
PID:4384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000014
2⤵
PID:2264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000015
2⤵
PID:436

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000016
2⤵
PID:1140

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000017
2⤵
PID:2536

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000018
2⤵
PID:1900

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000019
2⤵
PID:4064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001a
2⤵
PID:2380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001b
2⤵
PID:3776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001c
2⤵
PID:3808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001d
2⤵
PID:2292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001e
2⤵
PID:620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00001f
2⤵
PID:1348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000020
2⤵
PID:2624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000021
2⤵
PID:3152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000022
2⤵
PID:4572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000023
2⤵
PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000024
2⤵
PID:2316

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000025
2⤵
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000026
2⤵
PID:4556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000027
2⤵
PID:3372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000028
2⤵
PID:1848

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002b
2⤵
PID:4604

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002c
2⤵
PID:3480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002d
2⤵
PID:4856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002e
2⤵
PID:888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00002f
2⤵
PID:3876

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000030
2⤵
PID:1492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000031
2⤵
PID:2416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000032
2⤵
PID:1680

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000033
2⤵
PID:1608

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000034
2⤵
PID:1772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000035
2⤵
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000036
2⤵
PID:2152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000037
2⤵
PID:1572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000038
2⤵
PID:1524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000039
2⤵
PID:3808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003a
2⤵
PID:2292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003b
2⤵
PID:620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003c
2⤵
PID:1348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003d
2⤵
PID:2648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003e
2⤵
PID:3152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_00003f
2⤵
PID:4572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000040
2⤵
PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000041
2⤵
PID:3556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000042
2⤵
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000043
2⤵
PID:804

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000044
2⤵
PID:3372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000045
2⤵
PID:1848

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:3628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\f_000046
2⤵
PID:4328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cache\index
2⤵
PID:1712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies
2⤵
PID:2148

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Cookies-journal
2⤵
PID:3792

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db
2⤵
PID:3440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\databases\Databases.db-journal
2⤵
PID:1492

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_0
2⤵
PID:3024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_1
2⤵
PID:4552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_2
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\data_3
2⤵
PID:4324

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\GPUCache\index
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\000003.log
2⤵
PID:2288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\CURRENT
2⤵
PID:4820

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOCK
2⤵
PID:1484

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG
2⤵
PID:1672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\LOG.old
2⤵
PID:216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\IndexedDB\https_www.epicgames.com_0.indexeddb.leveldb\MANIFEST-000001
2⤵
PID:3432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage
2⤵
PID:2432

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_payment-website-pci.ol.epicgames.com_0.localstorage-journal
2⤵
PID:164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage
2⤵
PID:624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Local Storage\https_ssl.kaptcha.com_0.localstorage-journal
2⤵
PID:3624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager
2⤵
PID:3400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\QuotaManager-journal
2⤵
PID:3296

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\fe0c4ca0c0cbe875_0
2⤵
PID:1652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\index
2⤵
PID:4944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\5dff4910-44e7-4ef8-b06f-a66ce53e0e69\index-dir\the-real-index
2⤵
PID:1276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\779a3f11-745c-419e-bb8b-5b6f2e7e0547\index
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\779a3f11-745c-419e-bb8b-5b6f2e7e0547\index-dir\the-real-index
2⤵
PID:2240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\4bbf414005652440_0
2⤵
PID:4776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\index
2⤵
PID:4328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\e6f1282c-98d7-452b-bbde-050c09a94995\index-dir\the-real-index
2⤵
PID:3844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\0f02f0723dc027b2_0
2⤵
PID:2652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\8b79e197c1500c11_0
2⤵
PID:1716

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\a8a9373a71443d80_0
2⤵
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\a8a9373a71443d80_1
2⤵
PID:2416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\be52f68b51029c9d_0
2⤵
PID:4684

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\eda4eea3ffd63d3b_0
2⤵
PID:1208

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\eda4eea3ffd63d3b_1
2⤵
PID:1948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\index
2⤵
PID:3016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\f5fe54ed-e03a-40a0-80f8-d0350a52b7e3\index-dir\the-real-index
2⤵
PID:1940

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\CacheStorage\e60030e2e5440743857a39cacd108634434c91f1\index.txt
2⤵
PID:3028

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\000003.log
2⤵
PID:1204

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\CURRENT
2⤵
PID:224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOCK
2⤵
PID:4504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG
2⤵
PID:2396

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\LOG.old
2⤵
PID:1896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\Database\MANIFEST-000001
2⤵
PID:1192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_0
2⤵
PID:4164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\013888a1cda32b90_1
2⤵
PID:4468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_0
2⤵
PID:800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\2cc80dabc69f58b6_1
2⤵
PID:4392

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_0
2⤵
PID:2304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\4cb013792b196a35_1
2⤵
PID:5068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_0
2⤵
PID:2168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\67a473248953641b_1
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_0
2⤵
PID:2240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\b6c28cea6ed9dfc1_1
2⤵
PID:1728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_0
2⤵
PID:1812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\ba23d8ecda68de77_1
2⤵
PID:3948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_0
2⤵
PID:2652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\f1cdccba37924bda_1
2⤵
PID:2860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\fa813c9ad67834ac_0
2⤵
PID:2872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index
2⤵
PID:4916

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Service Worker\ScriptCache\index-dir\the-real-index
2⤵
PID:908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\EpicGamesLauncher\Saved\webcache\Visited Links
2⤵
PID:4904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Cloud\65f6b08d488442e694b1e23d152d971e\ClientSettings.Sav
2⤵
PID:5040

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\CrashReportClient\UE4CC-Windows-FA58D227408B75B949C1ECA1ABE0D4C7\CrashReportClient.ini
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini
2⤵
PID:2288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Demos\UnsavedReplay-2020.06.08-22.56.55.replay
2⤵
PID:3776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\LMS\Manifest.sav
2⤵
PID:4272

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\Logs\FortniteGame.log
2⤵
PID:4540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved\PersistentDownloadDir\CMS\CacheAccess.json
2⤵
PID:768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:2736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:1324

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:4840

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\Public\Libraries\desktop.ini
2⤵
PID:5056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\ntuser.pol
2⤵
PID:5008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Users\Default\NTUSER.DAT
2⤵
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:3720

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\keyboard.pnf
2⤵
PID:872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\netrasa.pnf
2⤵
PID:3796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\INF\netavpna.pnf
2⤵
PID:1152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\keyboard.inf_loc
2⤵
PID:2088

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\keyboard.inf_loc
2⤵
PID:2572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\keyboard.inf_loc
2⤵
PID:1596

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\bthpan.inf_loc
2⤵
PID:3480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\bthpan.inf_loc
2⤵
PID:3068

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\bthpan.inf_loc
2⤵
PID:1164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\netvwifimp.inf_loc
2⤵
PID:3540

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\netvwifimp.inf_loc
2⤵
PID:4360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\netvwifimp.inf_loc
2⤵
PID:1416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-GB\b57nd60a.inf_loc
2⤵
PID:3172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en\b57nd60a.inf_loc
2⤵
PID:2012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\Windows\System32\DriverStore\en-US\b57nd60a.inf_loc
2⤵
PID:2400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:1860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:4500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\Public\Libraries\desktop.ini
2⤵
PID:640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\ntuser.pol
2⤵
PID:5080

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Users\Default\NTUSER.DAT
2⤵
PID:2108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:2200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:2736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:1324

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:4840

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Users\Public\Libraries\desktop.ini
2⤵
PID:4700

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\ntuser.pol
2⤵
PID:5008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Users\Default\NTUSER.DAT
2⤵
PID:1760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:2868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\data.dat
2⤵
PID:872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\tokens.dat
2⤵
PID:3796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\spp\store\2.0\cache\cache.dat
2⤵
PID:3372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Users\Public\Libraries\desktop.ini
2⤵
PID:1276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\ntuser.pol
2⤵
PID:2532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Users\Default\NTUSER.DAT
2⤵
PID:1580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\XboxLive\AuthStateCache.dat
2⤵
PID:4680

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
2⤵
PID:4856

C:\Windows\system32\reg.exe
reg delete HKLM\SOFTWARE\WOW6432Node\EasyAntiCheat /f
3⤵
- Modifies registry key
PID:4692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
2⤵
PID:4948

C:\Windows\system32\reg.exe
reg delete HKLM\system\ControlSet001\Services\EasyAntiCheat /f
3⤵
- Modifies registry key
PID:3968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg delete HKLM\system\ControlSet001\Services\BEService /f
2⤵
PID:3440

C:\Windows\system32\reg.exe
reg delete HKLM\system\ControlSet001\Services\BEService /f
3⤵
- Modifies registry key
PID:3660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh winsock reset
2⤵
PID:4576

C:\Windows\system32\netsh.exe
netsh winsock reset
3⤵
PID:3024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh winsock reset catalog
2⤵
PID:1140

C:\Windows\system32\netsh.exe
netsh winsock reset catalog
3⤵
PID:2904

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int ip reset
2⤵
PID:4480

C:\Windows\system32\netsh.exe
netsh int ip reset
3⤵
PID:4304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh advfirewall reset
2⤵
PID:2940

C:\Windows\system32\netsh.exe
netsh advfirewall reset
3⤵
- Modifies Windows Firewall
PID:4640

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int reset all
2⤵
PID:640

C:\Windows\system32\netsh.exe
netsh int reset all
3⤵
PID:1236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int ipv4 reset
2⤵
PID:3112

C:\Windows\system32\netsh.exe
netsh int ipv4 reset
3⤵
PID:1624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c netsh int ipv6 reset
2⤵
PID:4168

C:\Windows\system32\netsh.exe
netsh int ipv6 reset
3⤵
PID:2008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /release
2⤵
PID:1380

C:\Windows\system32\ipconfig.exe
ipconfig /release
3⤵
- Gathers network information
PID:4840

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /renew
2⤵
PID:3376

C:\Windows\system32\ipconfig.exe
ipconfig /renew
3⤵
- Gathers network information
PID:544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ipconfig /flushdns
2⤵
PID:4596

C:\Windows\system32\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:2580

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:1180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\INF
2⤵
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\Public\Documents
2⤵
PID:4264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
2⤵
PID:4768

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2240

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:2572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\temp
2⤵
PID:952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:3508

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:3500

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:4688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:1480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\Prefetch
2⤵
PID:3172

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:2536

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q C:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:1140

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:4180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:4760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:1468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:2496

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:3760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:2200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:768

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:3812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:4120

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q C:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:1796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:5056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Temp
2⤵
PID:1264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:4392

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:2304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:4944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Users\%username%\Intel
2⤵
PID:4860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:1152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "C:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:1472

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:3404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\INF
2⤵
PID:3480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:3948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\Public\Documents
2⤵
PID:2860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\Prefetch
2⤵
PID:4452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:4872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:1680

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\temp
2⤵
PID:1808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:3344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:2504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:1860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:3776

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\Prefetch
2⤵
PID:3280

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:2196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q D:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:1672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:2648

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2736

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:2120

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:1084

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:3516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:3400

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:4816

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:4352

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:3556

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q D:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:2692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:3372

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Temp
2⤵
PID:2532

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:1600

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:4680

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:4856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Users\%username%\Intel
2⤵
PID:440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q D:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:4256

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "D:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:3748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:4872

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:2416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\INF
2⤵
PID:2192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:4324

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\Public\Documents
2⤵
PID:4836

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\Prefetch
2⤵
PID:4760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:1468

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:2496

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\temp
2⤵
PID:2108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:1908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:4824

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:1192

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\Prefetch
2⤵
PID:544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q E:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:1036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q E:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:4448

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:2304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:4944

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:3328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:232

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:1404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:4220

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:4328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:4968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q E:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:3320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:4960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Temp
2⤵
PID:3440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:1268

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:3332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:2012

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Users\%username%\Intel
2⤵
PID:2276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q E:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:3016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "E:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:4000

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:3384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\INF
2⤵
PID:2496

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:4504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\Public\Documents
2⤵
PID:2196

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\Prefetch
2⤵
PID:3812

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:3084

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:2808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\temp
2⤵
PID:1796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1084

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:3516

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:4672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:1016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\Prefetch
2⤵
PID:724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q F:\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:1184

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q F:\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:2088

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:2592

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:1544

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2984

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:4680

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:4968

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:4796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:2588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:1060

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:4628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q F:\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:2536

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:4668

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Temp
2⤵
PID:2428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:1032

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:4896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Users\%username%\Intel
2⤵
PID:224

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q F:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:1484

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "F:\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:2200

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Temp
2⤵
PID:4772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:1624

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s %systemdrive%\$Recycle.Bin >nul 2>&1
2⤵
PID:4956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s d:\$Recycle.Bin >nul 2>&1
2⤵
PID:4168

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s e:\$Recycle.Bin >nul 2>&1
2⤵
PID:1796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rd /q /s f:\$Recycle.Bin >nul 2>&1
2⤵
PID:552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\servicing\InboxFodMetadataCache
2⤵
PID:4840

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:1760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:1180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete
2⤵
PID:2304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\INF
2⤵
PID:724

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\%username%\Microsoft\XboxLive\NSALCache
2⤵
PID:3348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:4072

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:1728

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:4336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\temp
2⤵
PID:1244

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:1164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Logs
2⤵
PID:3480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:4708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:4660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:1756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:2264

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:2712

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\USOShared\Logs
2⤵
PID:3332

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:1948

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:4560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:3024

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:2696

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:2288

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:3808

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:1360

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:1632

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:744

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:2108

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:3772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:3880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:2988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir / s / q %systemdrive%\Users\%username%\AppData\Local\Temp
2⤵
PID:408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\Microsoft\Windows\CloudStore
2⤵
PID:1868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\FortniteGame\Saved
2⤵
PID:4412

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\INF
2⤵
PID:3600

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\%username%\Microsoft\XboxLive
2⤵
PID:4416

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\Public\Documents
2⤵
PID:4832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:1228

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\D3DSCache
2⤵
PID:3328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\CrashReportClient
2⤵
PID:232

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\temp
2⤵
PID:1856

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\SettingSync\metastore
2⤵
PID:1404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\SoftwareDistribution\DataStore\Logs
2⤵
PID:1340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\ProgramData\Microsoft\Windows\WER\Temp
2⤵
PID:1356

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\AMD\DxCache
2⤵
PID:4692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\Prefetch
2⤵
PID:2860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\username%\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\*.*
2⤵
PID:3440

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\WebCache\*.*
2⤵
PID:960

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @del /s /f /a:h / a : a / q %systemdrive%\Users\%username%\AppData\Local\Microsoft\XboxLive\*.*
2⤵
PID:5076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\AC
2⤵
PID:1620

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache
2⤵
PID:1772

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\Settings
2⤵
PID:4064

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\Engine\Plugins
2⤵
PID:4408

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Plugins
2⤵
PID:2380

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\PersistentDownloadDir
2⤵
PID:208

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Program Files\Epic Games\Fortnite\FortniteGame\Config
2⤵
PID:3384

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\NVIDIA Corporation
2⤵
PID:1236

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Roaming\EasyAntiCheat
2⤵
PID:4504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\NetworksCache
2⤵
PID:2292

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c del /f /s /q %systemdrive%\ProgramData\Microsoft\DataMart\PaidWiFi\Rules
2⤵
PID:1456

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache
2⤵
PID:4956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Temp
2⤵
PID:3152

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCache
2⤵
PID:5056

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies
2⤵
PID:5008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IEDownloadHistory
2⤵
PID:3376

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatUaCache
2⤵
PID:800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\IECompatCache
2⤵
PID:5096

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\DNTException
2⤵
PID:3036

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE
2⤵
PID:3328

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History
2⤵
PID:3796

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Windows\History\Low
2⤵
PID:1956

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState
2⤵
PID:3336

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\EcsCache0
2⤵
PID:1340

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState
2⤵
PID:5092

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\TargetedContentCache\v3
2⤵
PID:3480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\Intel
2⤵
PID:3164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData
2⤵
PID:3324

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q "%systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:3020

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\Microsoft\Feeds Cache
2⤵
PID:1480

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c rmdir /s /q %systemdrive%\Users\%username%\AppData\Local\EpicGamesLauncher
2⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
1⤵
PID:408

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv TfQf5Lfv/UmzJhgNIbLKYw.0.2
1⤵
PID:2016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4528

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
6e8146eccde20e082894650aa163c59f

SHA1
680f557922bfa4eb709437e9eef865ea07d04946

SHA256
cc34f424ae52d23e82291f87dd84d41a409c008d355465eee3bdbe893ba3cb3c

SHA512
caf295c7367fcd6e036dc71f63108cb4f1d7da08c6a8277d4c9f11ef3063cb699ed518fba9ffb7a6c6096b7fbcd8b937b86853e10f5e2b82ee1d13d56e71041b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
38fe42299cb4b4a383ee51cad3c2286b

SHA1
afd18d5bcf7ae1b8d34dc6c819e9bddeb9d3f027

SHA256
87313be8d7ef0c28044bd33f11899e1fbeef4a4f09edadfc4c70eebd1001e1a3

SHA512
daeaa74b40104b5d3caeace99c6cf818d9fe3e69f8810ac5dc984e2bc537567467e38e77629b356dff1d0d5fd4d572e300896bbbb793907dcff2e92d9584364f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Filesize
137B

MD5
a62d3a19ae8455b16223d3ead5300936

SHA1
c0c3083c7f5f7a6b41f440244a8226f96b300343

SHA256
c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e

SHA512
f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Filesize
112B

MD5
527f14e647395a6b372d122e4052f799

SHA1
cedb3d36e43843916316d8bc2bea1ae7997f00cc

SHA256
eb2a5d3ddaf9e0bc9c3ed06db499722274f5a85d935675ed0bf1680fc7c99668

SHA512
3fdea2e4ce2ba6a7472b8717ebe63b49743c2b3580553e5912f1102c9375efe142db69c07d1becbe5acc1a95af862538aeb753f9e095544567b7d28e1ff466c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Filesize
187B

MD5
d84717daa3b1601f76e995042253642a

SHA1
f09c5973786e7640c66cf04892d16ad3cb28c456

SHA256
9a4c8a684455eb87bf8ac6da6d9f177182b4cbf2efeca63f987eb9a101ceeac4

SHA512
a601288cafccb446fc1eda05fdb81f80899c24403db58c6a6e831a23ab4df5176455097a2d58f1ff4a63f32a33fd78781f77a56f072fed75b44ef37bb098c614

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Filesize
531B

MD5
1f933222435d1d0c3a4cc7f48e9a322a

SHA1
e0f2e7e1e9d7acea3964ec66508f7cf71e3b376a

SHA256
1d1b01eeba7ffc42f116f57c7c289e098d2e8197b38dbd91eb794564dccddd61

SHA512
38d2a146ed009bbee51777a3b139b2064dbf27dff1f333d3e2fac45b2c5b490e9fd5687a4b607e000ca514010366ab65c780376f6373d3332dc1ffd0079d0fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
08bf402e4b0f91996d455926ae8efc8b

SHA1
a8c7ffc76f9e2687174d44e45d41e221de71732c

SHA256
f73a104f6f22fed51b852b04a533de211f61b97bb53d7dff34a452918634bb0c

SHA512
c64b82c0aeb64619dc15f4b5ca8fd1d29b2ffa469ab30a13989c076e663a9b645a63b1aef34ffcb1149e92165828459fc6201898ee864c5f626d5e558984c7eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
6d9d6f4619fdd5505f8945271d4e8c02

SHA1
0571a82178688363db6b7d289bde3f3b968184c3

SHA256
20ae9a0bc5bb624dd4f874b14de562be7e21f079f0c7cbadc2a1726be8e344df

SHA512
936b060ace5172c95056ed1b8c92fa86dce7d4c0be6d871caa766a09fb8661f9e191ed72bd81d6eb640cb2ca0e2eaba520d50c4336ba59f1e2960edde8966e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
\??\pipe\LOCAL\crashpad_2132_UPOWKIETESEIOBZW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4608-51-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-4-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-3-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-0-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-2-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-6-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-5-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-1-0x00007FF80DFF0000-0x00007FF80DFF2000-memory.dmp

Filesize
8KB

Download
memory/4608-169-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download
memory/4608-176-0x00007FF712A60000-0x00007FF713184000-memory.dmp

Filesize
7.1MB

Download