4688 2 0 13312 0 0x8020000000000000 157802 Security EC2AMAZ-2RSGUKB S-1-5-21-3081580237-2860106967-1440473398-1009 user EC2AMAZ-2RSGUKB 0xa90590 0x1e34 C:\Windows\System32\cmd.exe %%1938 0x1e3c "C:\Windows\system32\cmd.exe" /c "%APpData:~ -10, 1%%comMonproGrAMFILES(x86):~ 8, -26%%LocALAPpdATa:~ 4, 1%k%TmP:~ -8, -7%%programfileS:~ -4, -3%%Os:~ 6, 1%%alluSerSProfile:~ 12, 1%" S-1-0-0 - - 0x0 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe S-1-16-8192 4104 1 5 2 15 0x0 120584 Microsoft-Windows-PowerShell/Operational EC2AMAZ-2RSGUKB 1 1 cmd /c “%APpData:~ -10, 1%%comMonproGrAMFILES(x86):~ 8, -26%%LocALAPpdATa:~ 4, 1%k%TmP:~ -8, -7%%programfileS:~ -4, -3%%Os:~ 6, 1%%alluSerSProfile:~ 12, 1%” 76137b2f-183d-4c1b-b70b-3ef956c2b1ea 4688 2 0 13312 0 0x8020000000000000 149591 Security EC2AMAZ-34S98QL S-1-5-21-4224902346-1214373562-3362504726-1009 user EC2AMAZ-34S98QL 0xb6c3b5 0x1418 C:\Windows\System32\cmd.exe %%1938 0xe50 cmd /c ip""con""fig S-1-0-0 - - 0x0 C:\Windows\System32\cmd.exe S-1-16-8192 4104 1 5 2 15 0x0 120584 Microsoft-Windows-PowerShell/Operational EC2AMAZ-2RSGUKB 1 1 cmd /c “%APpData:~ -10, 1%%comMonproGrAMFILES(x86):~ 8, -26%%LocALAPpdATa:~ 4, 1%k%TmP:~ -8, -7%%programfileS:~ -4, -3%%Os:~ 6, 1%%alluSerSProfile:~ 12, 1%” 76137b2f-183d-4c1b-b70b-3ef956c2b1ea