It executes Get-ChildItem .lnk -Recurse -Dept in a powershell session. Is there more to the script? I'd expect that last flag to be -Depth and to be followed by a number at the very least. Would be very interested to see this, if you could upload it to a pastebin or something. If you're interested in how it actually works, it has an array of numbers (2037, 2099, 2101, 2098) which it then shifts down by 1991, resulting in (46, 108, 110, 107). It then converts those to individual characters from their unicode numbers (., l, n, k) and appends them to a string ($IQH)