4688 2 0 13312 0 0x8020000000000000 1289571 Security WIN10-21H1.snapattack.labs S-1-5-21-1538153195-943065003-848949206-1000 localuser WIN10-21H1 0x61a55 0x1bbc C:\Windows\System32\cmd.exe %%1936 0x2204 C:\Windows\system32\cmd.exe /c ""C:\Program Files\Microsoft SDKs\Azure\CLI2\wbin\az.cmd" ad user create --display-name atomicredteam --password reallylongcredential12345ART-ydsfghsdgfhsdgfhgsdhfg --user-principal-name atomicredteam@snapattack.onmicrosoft.com" S-1-0-0 - - 0x0 C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe S-1-16-12288