(Image:\\w3wp.exe OR ParentImage:\\w3wp.exe) (CommandLine:&ipconfig&echo* OR CommandLine:&quser&echo* OR CommandLine:&whoami&echo* OR CommandLine:&c\:&echo* OR CommandLine:&cd&echo* OR CommandLine:&dir&echo* OR CommandLine:&echo\ \[E\]* OR CommandLine:&echo\ \[S\]*)