ad88680dce3d5c03d5bb6c46b4d0008eceb29780cd53c2673957f6de3e5c9a6b

Analysis

max time kernel
39s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IPOS TROJAN.bat
Size 15KB
Sample260806-qfpj6aaa42
SHA256 ad88680dce3d5c03d5bb6c46b4d0008eceb29780cd53c2673957f6de3e5c9a6b
MD5 1a3e5a943dafc92f119fc883bcae883f
SHA1 52eaba78180722db5307581f59d1b8ca3e5d1b9e
SHA512 fba6bb1c3e4a5c00905930f82dbec68e5c310dec803b9807427cc18587c144af8fe166a3b1afe883255da99124d8e4d04338cf5940aa8b72f59a837000d5155a
SSDEEP 384:rp8s4Qqxei6A+hIRL1TE5ArgNxknHYz6kduZLRGF/DVyaHz460H0JGp6bFPF5iDE:rvl57tLXJsK
TLSH
T1286272633A588C6DC2064CA0A9B798457355A08BD0413DE4B6EE91E2EF317D1EF36ECD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3200	powershell.exe
1240	powershell.exe
6004	powershell.exe
4924	powershell.exe
5864	powershell.exe
1524	powershell.exe
2464	powershell.exe
3644	powershell.exe
5540	powershell.exe
5912	powershell.exe
5912	powershell.exe
3200	powershell.exe
3836	powershell.exe
484	powershell.exe
3296	powershell.exe
4884	powershell.exe
2348	powershell.exe
4972	powershell.exe
2308	powershell.exe
484	powershell.exe
5188	powershell.exe
4484	powershell.exe
5384	powershell.exe
2776	powershell.exe
6140	powershell.exe
4988	powershell.exe
1216	powershell.exe
2468	powershell.exe
3244	powershell.exe
1216	powershell.exe
4288	powershell.exe
3136	powershell.exe
5580	powershell.exe
2584	powershell.exe
2100	powershell.exe
5176	powershell.exe
1780	powershell.exe
3504	powershell.exe
1028	powershell.exe
5216	powershell.exe
3180	powershell.exe
2576	powershell.exe
2684	powershell.exe
5628	powershell.exe
632	powershell.exe
6032	powershell.exe
5680	powershell.exe
5448	powershell.exe
3672	powershell.exe
4380	powershell.exe
4824	powershell.exe
5928	powershell.exe
4968	powershell.exe
2736	powershell.exe
3764	powershell.exe
2940	powershell.exe
6140	powershell.exe
1760	powershell.exe
2068	powershell.exe
248	powershell.exe
2184	powershell.exe
4884	powershell.exe
4352	powershell.exe
4428	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4396	powercfg.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
692	sc.exe
5812	sc.exe
1664	sc.exe
1592	sc.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4224	cmd.exe
4812	cmd.exe
908	cmd.exe
1172	cmd.exe
1036	cmd.exe
996	cmd.exe
5156	cmd.exe
3524	cmd.exe
4480	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5984	timeout.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4188	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6004	powershell.exe
6004	powershell.exe
3200	powershell.exe
3200	powershell.exe
1240	powershell.exe
1240	powershell.exe
1240	powershell.exe
296	WMIC.exe
296	WMIC.exe
296	WMIC.exe
296	WMIC.exe
5640	powershell.exe
5640	powershell.exe
5640	powershell.exe
4256	powershell.exe
4256	powershell.exe
4256	powershell.exe
1972	powershell.exe
1972	powershell.exe
1972	powershell.exe
2284	powershell.exe
2284	powershell.exe
2284	powershell.exe
5276	powershell.exe
5276	powershell.exe
5276	powershell.exe
3060	powershell.exe
3060	powershell.exe
3060	powershell.exe
5000	powershell.exe
5000	powershell.exe
5000	powershell.exe
2764	powershell.exe
2764	powershell.exe
2764	powershell.exe
5680	powershell.exe
5680	powershell.exe
5680	powershell.exe
4984	powershell.exe
4984	powershell.exe
4984	powershell.exe
6000	powershell.exe
6000	powershell.exe
6000	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
6004	powershell.exe
6004	powershell.exe
6004	powershell.exe
5932	powershell.exe
5932	powershell.exe
5932	powershell.exe
4204	powershell.exe
4204	powershell.exe
4204	powershell.exe
3680	powershell.exe
3680	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	3200	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeShutdownPrivilege	4396	powercfg.exe
Token: SeCreatePagefilePrivilege	4396	powercfg.exe
Token: SeIncreaseQuotaPrivilege	296	WMIC.exe
Token: SeSecurityPrivilege	296	WMIC.exe
Token: SeTakeOwnershipPrivilege	296	WMIC.exe
Token: SeLoadDriverPrivilege	296	WMIC.exe
Token: SeSystemProfilePrivilege	296	WMIC.exe
Token: SeSystemtimePrivilege	296	WMIC.exe
Token: SeProfSingleProcessPrivilege	296	WMIC.exe
Token: SeIncBasePriorityPrivilege	296	WMIC.exe
Token: SeCreatePagefilePrivilege	296	WMIC.exe
Token: SeBackupPrivilege	296	WMIC.exe
Token: SeRestorePrivilege	296	WMIC.exe
Token: SeShutdownPrivilege	296	WMIC.exe
Token: SeDebugPrivilege	296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	296	WMIC.exe
Token: SeRemoteShutdownPrivilege	296	WMIC.exe
Token: SeUndockPrivilege	296	WMIC.exe
Token: SeManageVolumePrivilege	296	WMIC.exe
Token: 33	296	WMIC.exe
Token: 34	296	WMIC.exe
Token: 35	296	WMIC.exe
Token: 36	296	WMIC.exe
Token: SeIncreaseQuotaPrivilege	296	WMIC.exe
Token: SeSecurityPrivilege	296	WMIC.exe
Token: SeTakeOwnershipPrivilege	296	WMIC.exe
Token: SeLoadDriverPrivilege	296	WMIC.exe
Token: SeSystemProfilePrivilege	296	WMIC.exe
Token: SeSystemtimePrivilege	296	WMIC.exe
Token: SeProfSingleProcessPrivilege	296	WMIC.exe
Token: SeIncBasePriorityPrivilege	296	WMIC.exe
Token: SeCreatePagefilePrivilege	296	WMIC.exe
Token: SeBackupPrivilege	296	WMIC.exe
Token: SeRestorePrivilege	296	WMIC.exe
Token: SeShutdownPrivilege	296	WMIC.exe
Token: SeDebugPrivilege	296	WMIC.exe
Token: SeSystemEnvironmentPrivilege	296	WMIC.exe
Token: SeRemoteShutdownPrivilege	296	WMIC.exe
Token: SeUndockPrivilege	296	WMIC.exe
Token: SeManageVolumePrivilege	296	WMIC.exe
Token: 33	296	WMIC.exe
Token: 34	296	WMIC.exe
Token: 35	296	WMIC.exe
Token: 36	296	WMIC.exe
Token: SeDebugPrivilege	5640	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeDebugPrivilege	5276	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	5680	powershell.exe
Token: SeDebugPrivilege	4984	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	6004	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 6004	3524	cmd.exe	90
PID 3524 wrote to memory of 3200	3524	cmd.exe	91
PID 3524 wrote to memory of 4188	3524	cmd.exe	92
PID 3524 wrote to memory of 5984	3524	cmd.exe	93
PID 3524 wrote to memory of 4224	3524	cmd.exe	94
PID 3524 wrote to memory of 5156	3524	cmd.exe	95
PID 3524 wrote to memory of 996	3524	cmd.exe	96
PID 3524 wrote to memory of 4480	3524	cmd.exe	97
PID 3524 wrote to memory of 1036	3524	cmd.exe	98
PID 3524 wrote to memory of 1172	3524	cmd.exe	99
PID 3524 wrote to memory of 908	3524	cmd.exe	100
PID 3524 wrote to memory of 4812	3524	cmd.exe	101
PID 3524 wrote to memory of 1240	3524	cmd.exe	102
PID 3524 wrote to memory of 4396	3524	cmd.exe	103
PID 3524 wrote to memory of 4576	3524	cmd.exe	104
PID 3524 wrote to memory of 692	3524	cmd.exe	105
PID 3524 wrote to memory of 5812	3524	cmd.exe	106
PID 3524 wrote to memory of 296	3524	cmd.exe	107
PID 3524 wrote to memory of 1664	3524	cmd.exe	109
PID 3524 wrote to memory of 1592	3524	cmd.exe	110
PID 3524 wrote to memory of 5800	3524	cmd.exe	111
PID 3524 wrote to memory of 5640	3524	cmd.exe	112
PID 3524 wrote to memory of 4924	3524	cmd.exe	113
PID 3524 wrote to memory of 4256	3524	cmd.exe	114
PID 3524 wrote to memory of 1608	3524	cmd.exe	115
PID 3524 wrote to memory of 1972	3524	cmd.exe	116
PID 3524 wrote to memory of 4260	3524	cmd.exe	117
PID 3524 wrote to memory of 2284	3524	cmd.exe	118
PID 3524 wrote to memory of 1432	3524	cmd.exe	119
PID 3524 wrote to memory of 5276	3524	cmd.exe	120
PID 3524 wrote to memory of 4856	3524	cmd.exe	121
PID 3524 wrote to memory of 3060	3524	cmd.exe	122
PID 3524 wrote to memory of 5448	3524	cmd.exe	162
PID 3524 wrote to memory of 5000	3524	cmd.exe	124
PID 3524 wrote to memory of 2756	3524	cmd.exe	125
PID 3524 wrote to memory of 2764	3524	cmd.exe	126
PID 3524 wrote to memory of 2600	3524	cmd.exe	202
PID 3524 wrote to memory of 5680	3524	cmd.exe	128
PID 3524 wrote to memory of 5548	3524	cmd.exe	129
PID 3524 wrote to memory of 4984	3524	cmd.exe	130
PID 3524 wrote to memory of 4964	3524	cmd.exe	131
PID 3524 wrote to memory of 6000	3524	cmd.exe	132
PID 3524 wrote to memory of 3040	3524	cmd.exe	133
PID 3524 wrote to memory of 3560	3524	cmd.exe	134
PID 3524 wrote to memory of 5912	3524	cmd.exe	135
PID 3524 wrote to memory of 4848	3524	cmd.exe	136
PID 3524 wrote to memory of 2924	3524	cmd.exe	137
PID 3524 wrote to memory of 2776	3524	cmd.exe	138
PID 3524 wrote to memory of 4412	3524	cmd.exe	139
PID 3524 wrote to memory of 6004	3524	cmd.exe	178
PID 3524 wrote to memory of 1540	3524	cmd.exe	141
PID 3524 wrote to memory of 5932	3524	cmd.exe	180
PID 3524 wrote to memory of 5528	3524	cmd.exe	143
PID 3524 wrote to memory of 4204	3524	cmd.exe	182
PID 3524 wrote to memory of 5552	3524	cmd.exe	251
PID 3524 wrote to memory of 3680	3524	cmd.exe	292
PID 3524 wrote to memory of 4356	3524	cmd.exe	147
PID 3524 wrote to memory of 248	3524	cmd.exe	148
PID 3524 wrote to memory of 1300	3524	cmd.exe	149
PID 3524 wrote to memory of 2736	3524	cmd.exe	296
PID 3524 wrote to memory of 4452	3524	cmd.exe	151
PID 3524 wrote to memory of 4924	3524	cmd.exe	189
PID 3524 wrote to memory of 5032	3524	cmd.exe	153
PID 3524 wrote to memory of 3180	3524	cmd.exe	154

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\IPOS TROJAN.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle hidden -command "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle hidden -command "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3200
- C:\Windows\system32\notepad.exe
  notepad.exe "C:\Users\Admin\AppData\Local\Temp\ipos_mesaj.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4188
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:5984
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:4224
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:5156
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:996
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:4480
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:1036
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:1172
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:908
- C:\Windows\system32\cmd.exe
  cmd /c "for /l %j in (1,1,99999999) do set /a x=%j*%j"
  2⤵
  - Executes a command shell one-liner
  PID:4812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -windowstyle hidden -command "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\system32\powercfg.exe
  powercfg -setacvalueindex scheme_current SUB_PROCESSOR PERFINCPOL 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Fan" /v EnableFanControl /t REG_DWORD /d 0 /f
  2⤵
  PID:4576
- C:\Windows\system32\sc.exe
  sc stop FanService
  2⤵
  - Launches sc.exe
  PID:692
- C:\Windows\system32\sc.exe
  sc config FanService start= disabled
  2⤵
  - Launches sc.exe
  PID:5812
- C:\Windows\System32\Wbem\WMIC.exe
  wmic /namespace:\\root\wmi path ThermalZoneTemperature delete
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:296
- C:\Windows\system32\sc.exe
  sc stop ACPI
  2⤵
  - Launches sc.exe
  PID:1664
- C:\Windows\system32\sc.exe
  sc config ACPI start= disabled
  2⤵
  - Launches sc.exe
  PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3140
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3656
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4852
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:6016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3644
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2924
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:2388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:4456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:4936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:1084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ( echo [System.Console]::Beep(2000, 500 )"
  2⤵
  PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -command -
  2⤵
  PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489